Auditor Help: Using Report Definitions

Note!  Notes: The ability to edit report definitions is available in the Auditor Professional version of the Ecora software, NOT in Auditor Basic. If you are interested in the Auditor Professional edition, please contact a sales representative.
Report definitions included with the product cannot be deleted or edited. They can be copied and modified, but not changed and saved with the same name.

Select a Report Definition

  1. Use the uppermost set of tabs to select the area of the report:
          OS includes Windows, Unix, and Novell NetWare operating systems.
          DB includes Oracle and MS-SQL databases.
          Web includes Internet Information Services (IIS).
          Messaging includes Exchange and Domino systems.
          Network includes Citrix and Cisco routers and L3 switches.
          Directory Services includes Active Directory (AD).
    Fact-Finding Report Selection
  2. Use the second set of tabs to select the module for the report.
  3. Use the left-hand pane to navigate to, expand, and select the general information you wish to include.
  4. Select the report in the right pane. (Default reports cannot be edited; select and click Copy if you wish to edit.)
    Fact-Finding Report Definition Editor
  5. Click Next >.

    Editing a Report Definition

  6. Use the second set of tabs to select the module for the report.
  7. Use the left-hand pane to navigate to, expand, and select the general information you wish to include.
  8. Once populated, use the center pane to select the settings to include.
  9. Click Edit in the table if the report already contains a table
    OR
    click the New Table button to begin defining a table.
    OR
    click the Edit Table button to begin editing the selected table.
    Helpful Hint Tip: Fact-Finding Reports are formatted as a series of tables containing the results of the queries you define in this dialog box. You can choose to present only one attribute per table or to group related settings in one table.
  10. Enter a table name and description (double-click in the cell to edit).
  11. Select an attribute from the center pane and drag it to the table name below, releasing the mouse when the plus sign appears.
  12. Repeat with any additional attributes you wish to include in the same table.
  13. Click on the Edit button to the left of the table name.
    Fact-Finding Report Table Editor
  14. For each attribute you added, there is a column in the table. If you wish to Sort the results, use the drop-down to select Ascending or Descending.
  15. If you wish to change the column order for the report, double-click in the cell for Output Column under each and enter the number for the column order (1 = first column, 2 = second and so on).
  16. If you wish to filter data based on criteria (such as password age is more than 15 days), double-click in the cell for Criteria in the column for the attribute.
    Filter dialog box
  17. Use the drop-down to select the appropriate operator (see operator explanations).
  18. Enter the value for your filter. For example, if you choose a numeric operator, like greater than, you might enter a number; if you choose LIKE, you might enter a string value, etc.
    Helpful Hint Tip: To use operators requiring two values, such as BETWEEN and NOT BETWEEN, use the Add button after entering the first value, then enter the second and click Add again.
    The Mod(ify) and Del(ete) buttons also apply to the current selection in the value box / drop-down.
  19. Click OK.
  20. If you wish to create a compound filter (two criteria), click on the ellipsis button under Criteria and use the drop-down to select the appropriate operator (AND, OR, or NOT), then repeat steps 15-18.
    Helpful Hint Tip: Add values in the new row under the attributes you want to further filter. Operators in the same row automatically take the AND operator. Each OR statement must be in an additional separate row.
  21. Click in the checkbox to enable the Distinct option to return only unique (vs duplicate) records.
  22. If you would like to see the underlying SQL query, click View SQL button (if enabled under Settings... Preferences).
  23. If you would like to modify the underlying SQL query, click Edit SQL button (if enabled under Settings... Preferences).
  24. Click Save.
  25. Verify or change the report title, description, or category.
  26. Proceed with standard FFR report generation.

Helpful Hint Tips:

  • The SQL wildcard is the percent sign % (for letters and numbers).
  • Use the Distinct check box to eliminate duplicate rows in a report.
  • The merge sort criteria collapses similar entries in a columnthe so the value only appears once.
  • Add criteria to attributes and use the IS NOT NULL operator to eliminate Null / blank entries.
  • Reports are cleaner if attributes and their labels, such as system and an attribute, are pulled from the same area of the tree.
  • To put related attributes in a single row and reference the same or like parent object (such as computer name pulled from the various areas of the tree), map like attributes to the same display column. For example, in creating a cross-platform report, Unix host name, Windows computer name, and Exchange server name could all be mapped to the first or second column to keep the report reasonably concise.
  • In Windows, the domain and server name attributes are often concatenated as domain/server. Use a wildcard (%) if you do not wish to specify both, such as %server1.
  • Date / time field are stored in the database as strings. To manipulate or use operators with them as date / times, use the Edit SQL feature.