Getting Started
- System Requirements
- Installation
- Registration
- Version Support Policy
- Assign Service Logon As Credentials
Agent-Based Management
Data Providers
- Data Provider Properties
- SQLite Properties
- MySQL Properties
- Microsoft SQL Server Properties
- File System Properties
Directory Services
Event Log Archiving for JSIG and CMMC Compliance
Auditing
- Audit Work Items
- Self-Auditing
- Group Policy Auditing
Hosts
- Adding Hosts
- Host Properties
- Batch Update Hosts
- Agent Properties
- Logon As Properties
- SFTP Properties
- FTP/S Properties
- SNMP Device Connection Properties
- WMI
- Contact
- Exclusions
- Inventory
- Docker
- Host Assignments
Templates
- Template Properties
- Batch Update Templates
- Assign Templates
- Log Management Templates
- SCAP Compliance Monitor
- File and Directory Monitor Templates
- Windows Monitor Templates
- Windows Management Instrumentation (WMI) Templates
- SSL Certificate Monitor Templates
- Email Monitor Templates
- SNMP Monitor Templates
- Windows Accounts Templates
Monitors
- Monitor Hierarchy
- Temporarily Suppress Monitors Actions
Reports
- Report Properties
- Artificial Intelligence Reports
  - AI Anomaly Detection Report
    - AI Anomaly Detection Report (Template Triggers)
- Security Reports
- Generic Log Reports
- SIEM Report
- SIEM Chart Report
- Azure Active Directory Audit Log Report
- Event Log Report
- SNMP Trap Report
- Syslog Report
- Databse Log Report
- Event Log Summary Report
File and Permission Reports
- File and Directory Access Permissions Report
- Duplicate Files Report
- File Activity Report
- Largest Files Report
- Sorted Files Report
Summary Reports
- Host Inventory Report
- Summary Report
- Collection Report
- Hash Check Reports
Auto-Configurators
Filters
- Simple Filters
- Complex Filters
Actions
- Database Actions
- Desktop Actions
- Email Actions
- Event Log Actions
- Executable Actions
- File Actions
- IIS IP Address Restriction Actions
- Microsoft Teams Actions
- PowerShell Actions
- Report Actions
- Service Actions
- SMS Actions
- SNMP Trap Actions
- Syslog Actions
- Template Actions
- IIS IP Address Restriction Actions
- Action Variables
Schedules
- Fixed Schedules
- Range Schedules
- Real-Time Schedules
Environment Variables
Options
- Email Settings
- Security Settings
- Syslog Server Settings
- SNMP Trap Server Settings
- Log Viewer Settings
- Web Proxy Settings
- Miscellaneous Settings
Account Lockout Monitoring and Reporting
Merging Logs
SNMP
- SNMP Browser
SSH Shell
Syslog
Exporting and Importing Configuration Objects
Shared Views
- Active Directory User and Group Filters
- Assign Actions
- Assign Azure Audit Logs
- Assign Consolidated Logs
- Assign Directories
- Assign Disks
- Assign Event Logs
- Assign Files
- Assign Services
- Assign Shares
- Auto-Config Host Assignment Properties
- Define CSV and W3C Log Entry Columns
- Define Log Entry Columns
- Define Log Entry Columns with Regular Expressions
- Executable Status
- Executable Timeline
- Explicitly Assigned Logs
- File Explorer
- General Executable Properties
- Report Columns
- Report Date/Time Ranges
- Report Security Event Log Filters
- Select Folder or File
- Target Files and Sub-Directories
Command Line Interface
Server Configuration
Agent Configuration
Troubleshooting
- Arithmetic Overflow
- Access Denied
- MySQL: Fatal error encountered during command execution
- Invalid Class
- No Such Interface Supported
- Quota Violation
- The File Exists Errors
- The Interface is Unknown
- The RPC Server is Unavailable
- NetBIOS Errors
Terminology

Azure Audit Log Consolidation Template

Azure Audit Log consolidation is the process of downloading Azure Audit Logs and saving them to a Data Provider, also known as a Log Database.

How to Configure Azure Audit Log Consolidation:

From the Menu Bar, select File | New. The Create New Object View displays.
From the Create New Object view, expand Template | Log Management then select Log Consolidation. The New Log Consolidation Template Properties view displays.
From the New Log Consolidation Template Properties view, use the Sub type drop-down to select Azure AD Audit Log. The Template Properties view now contains 7 tabs.

Logs Tab

The Logs Tab enables you to configure the Azure AD connection then select the logs to consolidate. Before you can configure the software to download Azure AD Audit Logs, you must create an App Registration in your Azure Portal. For more information see: Tutorial: Register an app with Azure Active Directory from Microsoft.

To create an App Registration in Azure:

Log into your Azure Portal at https://portal.azure.com/
Select Azure Services | Azure Active Directory. The Overview displays.
Click Manage | App Registrations. The App Registrations view displays.
Click New Registration. The Register an application view displays.
Use the name field to specify a name (e.g. CBSM), then click Register. The Properties view displays.

Note

Copy the Application (client) ID for later use.
Copy the Directory (tenant) ID for later use.

Select API Permissions. The API Permissions view displays.
Click Add a permission. The Request API permissions view displays.
Select Microsoft Graph then select Application permissions.
From the Select permissions text box type AuditLog.Read.All then check the option.
From the Select permissions text box type IdentityRiskEvent.Read.All then check the option.
Click Add permissions. Once the permissions are added, the API permissions view displays.
Click Grant admin consent then when prompted to confirm click Yes.
Click Manage | Certificates & secrets. The Certificates & secrets view displays.
Click New client secret. The Add a client secret view displays
Specify a name (e.g. MySecret) and an expiration date then click Add.

Note

Copy your new secret Value then save for later use.

To configure the Azure AD connection:

Use the Client ID text box to specify your Azure App registration's Application (client) ID.
Use the Tenant ID text box to specify your Azure App registration's Directory (tenant) ID.
Use the Client secret text box to specify your App registration's secret.

To select the logs to save:

Check the Audit Logs check box to select the Audit log.
Check the Sign-Ins check box to select the Sign-Ins log.
Check the Identity Risk Events check box to select the Identity Risk Events log.

Options Tab

Optionally assign a Consolidation filter to dump entries you do not want saved to the Log Database. When assigned, only entries that pass the assigned consolidation filter are saved to the Log Database.
Use the Initial number of days to download to configure the initial download. Subsequent downloads always pull from the last saved entry forward.

Important

If you have a heavily loaded domain controller you may need to limit the initial download of the Security Event Log to one day then build the database from that point on, otherwise you may receive a Quota Violation. You also have the option of specifying 0 days. When set to 0, Server Manager downloads the last hour of entries which should resolve any Quote Violation errors.

Use the Download in batches of option to minimize WMI results sizes. This option is yet another attempt to work around Quota Violation errors.