Auditing changes in policies and rules

This article applies to:

• Trustwave SEG 

Question:

• How can I determine who made changes to SEG policies and rules, and when the changes were made?

Procedure:

MailMarshal (SEG) 10

See the Audit History item in the Management Interface.

SEG 8.X

The following information is available in the Configurator for each Policy Group and Rule:

• Created By (Windows user)
• Created Time
• Last Modified By (Windows user)
• Last Modified Time

Additionally, the Array Manager text log includes a line titled AUDIT for each creation, deletion, or update of a Policy Group or Rule.

Notes:

• The MailMarshal (SEG) 10 audit information is stored in the Config Service database.
• The SEG 8.X audit information is stored in the product configuration (Registry) and is included in backups.