H3C Technologies H3C Intelligent Management Center - Manual (Page 29)

20
Managing user behavior audit
The user behavior audit management function allows you to perform the following tasks:
• Add, view, modify, and delete audit tasks of various audit types.
• View audit results.
The following information describes common operations for managing audit tasks and viewing audit
results. For more information about managing audit tasks of an audit type, see the related chapter of the
audit type.
Viewing user behavior audit list
1. Access the Settings page.
2. Click the User Behavior Audit Management link or icon .
The User Behavior Audit Management page appears and displays all audit tasks that have been
added.
User Behavior Audit Task List contents
{
Name—Name of the audit task. You can click the audit task name to view the audit task
details.
{
Server—IP address of the UBA server. When the UBA service module is installed on the IMC
platform server, this field displays the loopback address 127.0.0.1.
{
Type—Type of the audit task.
{
Audit—Allows you to click the Audit icon to view audit results for the audit task.
{
Modify—Allows you to click the Modify icon to modify the audit task.
{
Delete—Allows you to click the Delete icon to delete the audit task. Click the icon and click
OK on the confirmation dialog box that appears. To delete audit tasks in bathes, select one or
more audit tasks, click Delete, and click OK on the confirmation dialog box that appears.
NOTE:
To view the user behavior audit list for an audit type, select the corresponding audit type from the
navigation tree after you add audit tasks of the audit type.
Viewing audit results
Querying audit results for an audit task
By default, the audit result page for an audit task displays the audit results of the last one hour. You can
set the audit time to query the audit results generated in a specific period of time.
To query the audit results for an audit task:
1. Access the User Behavior Audit Management page.
2. Click the Audit icon for the audit task for which you want to view audit results.
The audit result page for the audit task appears.
3. In the query area, select any of the following options from the Audit Time list: