H3C Technologies H3C Intelligent Management Center - Manual (Page 48)

39
4.Managing general audit
General audit tasks allow you to audit user behaviors according to the source IP address, destination IP
address, source port, destination port, protocol, application, packet count, flux, and device.
Viewing general audit task details
1. Click the Service tab.
2. From the navigation tree, select Traffic Analysis and Audit > Settings.
3. The Settings page appears.
4. Access the Settings page.
5. Click the User Behavior Audit Management link or icon .
The User Behavior Audit Management page appears and displays all user behavior audit tasks
that have been added.
6. Click a user behavior task whose type is General.
The Custom General Audit Detail page appears.
Basic Info area
{
Name—Name of the general audit task.
{
Server—Name of the UBA server that audits user behaviors for the general audit task.
{
Reader—Operator groups that have the right to view the task.
Audit Condition area
{
Custom Query—Query type for the audit conditions: Meet All or Meet Any.
{
Access User—Account used by the access user that is managed by UAM.
{
Terminal Type—Type of the endpoint used by the access user.
{
Operating System—Operating system of the endpoint used by the access user.
{
Source—Source IP address of the user behavior.
{
Destination—Destination IP address of the user behavior.
{
Source Port—Source port number of the user behavior.
{
Destination Port—Destination port number of the user behavior.
{
Protocol—Protocol type of the user behavior: Unlimited, TCP, UDP, ICMP, or IPv6-ICMP.
{
Application—Applications of the user behavior.
{
Device—IP address of the device or probe that generates flow records.
The Access User, Terminal Type, and Operating System fields are displayed only when UBA
works with UAM.
7. Click Back to return to the User Behavior Audit Management page.