H3C Technologies H3C Intelligent Management Center - Manual (Page 71)

62
9.User behavior audit and audit analysis
User behavior audit
1. Click the Service tab.
2. From the navigation tree, select User Behavior Audit.
The User Behavior Audit page appears.
3. From the Server list, select the name of the UBA server that audits user behaviors.
4. In the Start Time and the End Time fields, set the start time and end time.
For more information about setting querying time, see "
Setting the query time ."
5. In the Audit Condition area, configure the general audit conditions.
The Audit Condition area displays the audit conditions of the general audit. For more information
about configuring audit conditions of the general audit, see "
Adding a general audit task ."
6. Select the Special Audit option and perform one or more of the following tasks:
{
Select the NAT Condition option, and configure NAT audit conditions on the area that appears.
For more information about configuring NAT audit conditions, see "
Adding a NAT audit task ."
{
Select the Web Visiting Audit option, and configure Web visiting audit conditions on the area
that appears. For more information about configuring Web visiting audit conditions, see
" Adding a Web visiting audit task ."
{
Select the FTP Condition option, and configure FTP audit conditions on the area that appears.
For more information about configuring FTP audit conditions, see "
Adding an FTP audit task ."
{
Select the Mail Condition option, and configure mail audit conditions on the area that appears.
For more information about configuring mail audit conditions, see " Adding a mail audit task ."
The Web Visiting Audit, FTP Audit, and Mail Audit options are displayed only when the
corresponding audit type is enabled in the server configuration.
7. Click Audit.
The Audit Result area displays the audit results.
To save the audit results, click Save. For more information about saving audit results, see "
Saving
audit results ."
User behavior audit analysis
1. Click the Service tab.
2. In the Network Monitoring Management area, click the User Behavior Audit Analysis link or icon
.
The User Behavior Audit Analysis page appears and displays the audit result of the last hour in
pie charts in the following areas, as shown in
Figure 7 :
{
Top 10 Source Host—Displays the top 10 source IP addresses with the most audit results and
the percentage of audit results of each source IP address. You can click the slice for a source IP
address to view audit results for the source IP address.