By Kyle Knebel
June 2024 Consultants Corner
With Laserfiche’s auditing functions in LF Cloud or in the Audit Trail add-on for on-premise systems, you can look out for the warning signs of bad behavior within your Laserfiche system. Auditing is done on the repositories that you maintain. It’s best to set up some saved reports that can help identify potential issues. In this month’s article, we’ll review a few helpful Audit reports.
These reports do not need any specific level of Audit Trail, although there are several to choose from. Even if you have the “Starter” edition, you can run these reports, as they are not User specific, and the example Event types used in this article are available to be audited in all editions. Let’s take a look!
First off, let’s look at Failed Logins. This could be an indicator of attempted break-ins.
1.) Set the “relative date” range to your preferred range.
2.) In the Event Types editor, select the “Log On” choice under the “Session” event.
3.) Filter the User List to remove any Service accounts like “SupportUser” or workflow accounts.
4.) Finally, press Apply to see the results, and press “Save” to retain the report for use later. When saving the report, choose whether to share it with others; otherwise, it will only be available to your account.
Next, let’s see if there are “Weekend Logins”. (We’ll assume nobody should be using the system over the weekend.)
1.) This time, create a similar “Log On” Event Type report but use a “Custom” date range. Filter out any service accounts and apply the settings.
Next, let’s see if there have been any Excessive Exports (this includes emails that count as downloads).
1.) Modify the Event Type to include any or all “Export and Print” types…
2.) Sort by the User column and exclude any service accounts that might already be automatically emailing documents. You may want to download the results as an Excel file. The Audit Report screen has a Download button, which allows you to export the report as an Excel file for further sorting and filtering.
Finally, check for Excessive Deletions.
1.) Edit the Event Types list, Reset and go to the Entry main Event type, then select Delete entry, Purge Entry, and Recycle Entry.
Note: Delete Entry is tracked whether the Recycle Bin is enabled or disabled. Recycle Entry means that an entry has been sent to the Recycle Bin, and Purge Entry indicates permanent deletion from the Recycle Bin.
Note: You may need to download the results as an MS Excel file to get filter and sorting options not available in the Audit Reports tool itself.
This concludes this month’s review of Audit reports to check for Red Flags in your Laserfiche system. We hope you found this post informative and useful!
CDI NEWSLETTER
Stay updated with all the latest Laserfiche news, CDI webinars, blogs, and more!
Comentarios