AuditIng-Related Objects and Properties

Most Audit Module for PowerShell cmdlets return object instances either directly or as properties of other objects. This section provides an alphabetical listing of the objects and the properties of each object defined in the Audit Module for PowerShell. Note that not all properties are available as parameters in the PowerShell cmdlets.

CdaAccessAccount

Represents a Windows user or SQL Server login account with access to auditing components. The following properties are defined for this object.

Property Type Description
AccountName String Name of the Windows user or SQL Server login account.
Type Enum Account type. The valid values are: 1 if the account is a Windows account that uses Windows authentication. 2 if the account is a Microsoft SQL Server login account that uses SQL Server authentication.

CdaAdPrincipal

Represents an Active Directory principal. The principal can be an Active Directory user, group, or computer account. You can use the Class property to identify the type of principal. Only the account name for the principal is stored in the database. The following properties are defined for this object.

Property Type Description
Class String Principal type of the Active Directory object.
DistinguishedName String Distinguished name of the Active Directory object.
Domain String Domain name for the Active Directory principal.
GUID Guid Globally unique identifier (GUID) for the Active Directory object.
Name String Name of the Active Directory object.
SamAccountName String The sAMAccountName attribute for the Active Directory principal.
SID Security identifier The security identifier (SID) for the Active Directory principal.

CdaAgent

Represents an audited computer where the auditing service is enabled. The following properties are defined for this object.

Property Type Description
AuditedSystemType Enum Specifies whether the audited systems are system-based ("SystemBased") or vault-based ("VaultBased"). This parameter is optional. If you do not specify this parameter, the results include a list of both types of audited systems. System-based describes a Windows or UNIX computer that is running an agent. You can access these systems either directly or from the Privileged Access Service Admin Portal. Vault-based describes a Windows or UNIX computer or a network device that is not running an agent (agentless). You can access these systems from the Privileged Access Service Admin Portal. Note: Some properties display different values for vault-based systems: * Version: this property is empty because vault-based systems are agentless * Status: this property displays as none * StartupTime: this property displays as a default date-time value of "1/1/0001 12:00:00 AM" * UpTime: this property displays as 00:00:00
LastUpdateTime DateTime Time at which the auditing service agent was last updated.
MachineAddress String IP address of the computer hosting the auditing service.
MachineName String Name of the computer hosting the auditing service.
MachineSid String Security identifier string for the computer hosting the auditing service.
StartupTime DateTime Time at which the auditing service agent first started.
Status Enum Status of the auditing service. The valid values are: Connected Disconnected
Type Enum Type of operating system running on the computer hosting the auditing service. The valid values are: 0 — Unknown 1 — UNIX 2 — Windows
UpTime TimeSpan Total time the auditing service agent was connected time from the startup time to the last update time.
Version String Auditing service agent version number.

CdaAuditEvent

Represents an audit trail event. The following properties are defined for this object.

Property Type Description
Description String Description of the audit trail event.
EventId Integer Event identifier for the audit trail event. Event instances that share the same event type will also have the same EventId.
EventName String Name of the audit trail event.
Machine String Computer name associated with the audit trail event.
Parameters String Array List of parameters for this audit trail event.
Result String Result returned by the audit trail event.
SessionId String Identifying string for the session associated with the audit trail event, if there is one.
SessionUri String The uniform resource identifier (URI) for the session associated with the audit trail event, if there is one.
Time DateTime Date and time the audit trail event occurred.
UniqueId Long Unique identifier for the event instance.
User String User name associated with the audit trail event.

CdaAuditRole

Represents an audit role. The following properties are defined for this object.

Property Type Description
Definition String String that defines the criteria used in the audit role to specify the sessions to include.
Description String Description of the audit role.
Name String Name of the audit role.
Privilege Enum array User privileges for the audited sessions that match the criteria specified for this audit role.

CdaAuditRoleAssignment

Represents an audit role assignment. The following properties are defined for this object.

Property Type Description
Assignee CdaAdPrincipal User, group, or computer account assigned to the audit role.
AuditRole CdaAuditRole Name of the audit role being assigned.

CdaAuditRoleRight

This object represents the rights granted to a trustee on the audit role. The following properties are defined for this object.

Property Type Description
AuditRole CdaAuditRole The audit role
Trustee String Trustee name in format <DOMAIN>\<User account name> Note: The consistent name format is shown in the Audit Manager console. For an orphan trustee, it shows SID in SDDL format.
TrusteeType String Indicate the type of the trustee,for example Active Directory User or Group
Rights string[] The collection of rights granted to the trustee on the audit role. Possible rights: Full Control Change Permissions Change Role Membership Change Role Definition

CdaAuditScope

Represents the audit scope for an audit store. The following properties are defined for this object.

Property Type Description
Definition String String that defines the audit scope. If the audit scope is an Active Directory site, this property is the site name. If the scope is a subnet, this property is the IP address and subnet mask.
Type Enum The type of audit scope. The valid values are: 1 if the audit scope is an Active Directory site. 2 if the audit scope is a network subnet segment.

CdaAuditSession

Represents an audited user session. The following properties are defined for this object.

Property Type Description
AuditStore String Name of the audit store.
ClientAddress String Client IP address.
ClientName String Client name.
Comment String array Comments that have been added by reviewers to the session.
EndTime DateTime Session end time.
IsADUser Boolean Indicates whether the user is an Active Directory user.
Machine String Host name of the computer where the session ran.
MachineAddress String Computer IP address of the computer where the session ran.
MachinePrincipal String Computer principal name of the computer where the session ran.
ReviewedBy ADUser Name of the user who last updated the review status for the session.
ReviewStatus Enum Session review status. The valid values are: 0 for None 1 for ToBeReviewed 2 for Reviewed 3 for PendingForAction 4 for KeepForever 5 for ToBeDeleted
ReviewTime DateTime Date and time of the last review status update for the session.
SessionID String Globally unique identifier (GUID) for the object.
Size Integer Total size of the session in KB.
StartTime DateTime Session start time.
State Enum Status of the session. The valid values are: -1 for Unknown 0 for InProgress 1 for Terminated 2 for Disconnected 3 for Completed
Tags String The tags associated with the audit session
Type Enum Session type. The valid values are: 1 if the session is a Windows session 2 if the session is a UNIX session
Uri String The uniform resource identifier (URI) for replaying the session in the session player.
User String User name associated with the session.
UserDisplayName String User display name associated with the session.
Zone String Server Suite zone name.

CdaAuditSessionTag

Represents the keyword tag that is associated with an audited session. The following properties are defined for this object.

Property Type Description
AuditStoreDatabaseId int The ID of the audit store database
Id long The ID of the tag
Mode string The mode of the tag, which indicates if the session was tagged by an automatic process or manually tagged. The possible values are: Manual Automatic
ReplayTimestamp DateTime The session replay time of the tag in the audit session
Session CdaAuditSession The audit session(s) that the tag is associated with
Tag string The tag
Tagger string The user name of the auditor who tagged the audit session
TagTimestamp DateTime The timestamp when the audit session was tagged

CdaAuditSessionDataIntegrityStatus

If you’ve enabled the audit store database for data integrity checking, this object refers to the session’s data integrity status. Data integrity checking provides the ability to detect if auditing data has been tampered. The following properties are defined for this object.

Property Type Description
Session CdaAuditSession The audited user session
Status Integer Unknown = -1 Passed = 0 Not Enabled = 1 Session Not Found = 2 Missing Final Thumbprint = 3 Invalid Final Thumbprint = 4 Missing Thumbprint = 5 Invalid Thumbprint = 6 Failed = 7
StatusMessage String The friendly display message of the status
Source String The source name of the audit session data (which contains the database table name and record Id)

CdaAuditStore

Represents an audit store. The following properties are defined for this object.

Property Type Description
Affinity AffinityType enum The type agents that the audit store serves, either Windows, UNIX, or both. The possible values are: WindowsAndUnix - 0 Windows - 1 Unix - 2
Name String Name of the audit store.
Scopes CdaAuditScope[] Audit store scopes.
TrustedAgentEnabled Boolean Whether the trusted agent filter is enabled or not.
TrustedAgents CdaComputer[] Trusted agent computers.
TrustedCollectorEnabled Boolean Whether the trusted collector filter is enabled or not.
TrustedCollectors CdaComputer[] Trusted collector service computers.

CdaAuditStoreRight

This object represents the rights granted to a trustee on the audit store. The following properties are defined for this object.

Property Type Description
AuditStore CdaAuditStore The audit store
Trustee String Trustee name in format <DOMAIN>\<User account name> Note: The consistent name format is shown in the Audit Manager console. For an orphan trustee, it shows SID in SDDL format.
TrusteeType String Indicate the type of the trustee,for example Active Directory User or Group
Rights string[] The collection of rights granted to the trustee on the auditstore. Possible rights: Full Control Change Permissions Modify Name Manage Scopes Manage SQL Logins Manage Collectors Manage Audited Systems Manage Databases Manage Database Trace

CdaCollector

Represents a collector service computer. The following properties are defined for this object.

Property Type Description
AuditStoreDatabase String The audit store database the collector connects to.
LastUpdateTime DateTime The date and time at which the collector received the last update.
MachineAddress String IP address of the computer hosting the collector service.
MachineName String Name of the computer hosting the collector service.
PortNumber Integer Collector connection port number.
Sid String Security identifier string for the computer hosting the collector service.
StartupTime DateTime The date and time at which the collector first connected to the audit store database.
Status Enum Status of the collector service. The valid values are: Connected Disconnected
UpTime TimeSpan Total time the collector was connected time from startup to the last update time.
Version String Collector service version number.

CdaDatabase

Represents an audit store database. The following properties are defined for this object.

Property Type Description
ActiveEndTime DateTime The date and time at which the database stopped being the active database.
ActiveStartTime DateTime The date and time this database became the active database.
AllowedCollectors CdaAccessAccount[] Allowed collector accounts.
AllowedManagementServers CdaAccessAccount[] Allowed management database accounts.
AuditStore CdaAuditStore The audit store object instance for the database.
CollectorCount Integer Number of collectors connected to the database.
Database String Microsoft SQL Server database name for the audit store database.
DiskUsage Integer Database file size, in 8KB pages.
IsActive Boolean Specifies whether this is the active database for the audit store.
Name String Display name of the audit store database.
RecordCount Integer Number of session records in the database.
Server String Microsoft SQL Server host name and instance.
Status Enum Database status. The valid values are: Connected Disconnected
Version String Database version number.

CdaDetailedExecution

Represents detailed command execution details, if advanced monitoring is enabled. The following properties are defined for this object.

Property Type Description
User String The user name associated with the event
Machine String The computer name associated with the event
Time DateTime The date and time when the command was executed
EnteredCommand String The name of the entered command
ExecutedCommand String The name of the executed command
CommandArguments String The command arguments
RunAsUser String The run as user name
AccessStatus String The access status: Succeeded or Failed
AccessStatusDetails String The detailed message about the status
CurrentDirectory String The current directory of the command execution
ProcessId String The process ID of the command execution
ParentProcessId String The process ID of the parent process of the command execution

CdaInstallation

Represents an audit installation. The installation defines the scope of the auditing infrastructure and audit data available for review and play back. The following properties are defined for this object.

Property Type Description
DisableSelfDelete Boolean Indicates whether users can delete their own sessions. This installation-wide option takes precedence over the permissions granted to a user account. If you set this option to be True, users cannot delete their own sessions regardless of the rights granted to their audit roles.
DisableSelfReview Boolean Indicates whether users can update the review status or the comments on their own sessions. This installation-wide option takes precedence over the permissions granted to a user account. If you set this option to be True, users cannot update the review status or add comments for their own sessions regardless of the rights granted to their audit roles.
EnableVideoCapture Boolean Indicates whether the video capture auditing of user activity is enabled or not.
ManagementDatabase CdaManagementDatabase The default connected management database for the installation.
Name String Name of the installation.
NotificationImage String Name of the notification banner image file in base64 string format.
NotificationMessage String Name of the file containing the notification message text.
PublishLocations String Array One or more Active Directory locations where the installation service connection point is published.

CdaInstallationRight

This object represents the rights granted to a trustee on the DA Installation. The following properties are defined for this object.

Property Type Description
Trustee String Trustee name in format <DOMAIN>\<User account name> Note: The consistent name format is shown in the Audit Manager console. For an orphan trustee, it shows SID in SDDL format.
TrusteeType String Indicate the type of the trustee,for example Active Directory User or Group
Rights string[] The collection of rights granted to the trustee on the DA Installation. Possible rights: Full Control Change Permissions Modify Name Manage Management Database List Manage Audit Store List Manage Collectors Manage Audited Systems Manage Audit Role Manage Queries Manage Publications Manage Licenses Manage Notification Manage Audit Option View

CdaManagementDatabase

Represents an audit management database. The following properties are defined for this object.

Property Type Description
AllowedIncomingUsers CdaUser[] Allowed incoming users of the management database.
Database String Microsoft SQL Server database name for the management database.
Name String Display name of the management database.
OutgoingAccount CdaAccessAccount Outgoing account of the management database.
Scope CdaAuditScope[] Audit store scopes defined for the management database.
Server String Microsoft SQL Server host name and instance name.
Status Enum Status of the management database. The valid values are: Connected Disconnected

CdaManagementDatabaseRight

This object represents the rights granted to a trustee on the management database. The following properties are defined for this object.

Property Type Description
ManagementDatabase CdaManagementDatabase The management database
Trustee String Trustee name in format <DOMAIN>\<User account name> Note: The consistent name format is shown in the Audit Manager console. For an orphan trustee, it shows SID in SDDL format.
TrusteeType String Indicate the type of the trustee,for example Active Directory User or Group
Rights string[] The collection of rights granted to the trustee on the management database. Possible rights: Full Control Change Permissions Modify Name Manage Scopes Remove Database Manage SQL Logins Manage Database Trace

CdaMonitoredExecution

Represents monitored command execution details, if advanced monitoring is enabled. The following properties are defined for this object.

Property Type Description
User String The user name associated with the event
Machine String The computer name associated with the event
Time DateTime The date and time when the command was executed
Command String The name of the executed command
CommandArguments String The command arguments
RunAsUser String The run as user name
AccessStatus String The access status: Succeeded or Failed
AccessStatusDetails String The detailed message about the status
CurrentDirectory String The current directory of the command execution
ProcessId String The process ID of the command execution
ParentProcessId String The process ID of the parent process of the command execution

CdaMonitoredFile

Represents monitored file details, if advanced monitoring is enabled. The following properties are defined for this object.

Property Type Description
User String The user name associated with the event
Machine String The computer name associated with the event
Time DateTime The date and time when the command was executed
FileName String The filename of the file being accessed
Command String The name of the executed command
RunAsUser String The run as user name
SystemCallName String The name of the system call
AccessType String The type of the file access: Write or ChangeAttribute
AccessStatus String The access status: Succeeded or Failed
AccessStatusDetails String The detailed message about the status
CurrentDirectory String The current directory of the command execution
ProcessId String The process ID of the command execution
ParentProcessId String The process ID of the parent process of the command execution

CdaQuery

This object represents a query. The following properties are defined for this object.

Property Type Description
Name String The query name
Description String The query description
IsPredefined boolean Whether this query is predefined or not

CdaQueryRight

This object represents the rights granted to a trustee on the query. The following properties are defined for this object.

Property Type Description
Query CdaQuery The query
Trustee String Trustee name in format <DOMAIN>\<User account name> Note: The consistent name format is shown in the Audit Manager console. For an orphan trustee, it shows SID in SDDL format.
TrusteeType String Indicate the type of the trustee,for example Active Directory User or Group
Rights string[] The collection of rights granted to the trustee on the query. Here are the possible rights: Full Control Change Permissions Read Delete Modify

CdaSearchCriteria

Represents a search criteria object that defines the filters to use to find sessions that can be passed to other cmdlets. For example, you can create a search criteria object to define the sessions that are applicable for a given audit role. The following properties are defined for this object.

Property Type Description
Application String array Filter sessions by using the Windows application name used.
AuditStore String Filter sessions by using the name of the audit store.
ClientName String Filter sessions by using the client name of the session.
Comment String array Filter sessions by using the comments that have been added by reviewers to the session.
Group String array Filter sessions by using the session owner's Active Directory security group.
Installation String Filter sessions by using the name of the audit installation.
Machine String Filter sessions by using the host name of the computer where the session ran.
ReviewStatus Enum Filter sessions by using the session review status. The valid values are: 0 for None 1 for ToBeReviewed 2 for Reviewed 3 for PendingForAction 4 for KeepForever 5 for ToBeDeleted
State Enum Filter sessions by using the status of the session. The valid values are: 0 for InProgress 1 for Terminated 2 for Disconnected 3 for Completed
TimeAfter DateTime Filter sessions that ran after a specific date and time.
TimeBefore DateTime Filter sessions that ran before a specific date and time.
TimeBetween DateTime Filter sessions that ran between a start time and an end time.
Type Enum Filter sessions by using the session type. The valid values are: 1 if the session is a Windows session 2 if the session is a UNIX session
UnixCommand String array Filter sessions by using the UNIX command line input and output.
UnixCommandName String array Filter sessions by the UNIX command name only.
UnixCommandTimeAfter DateTime Filter sessions that ran after a specific date and time based on the UNIX command input time.
UnixCommandTimeBefore DateTime Filter sessions that ran before a specific date and time based on the UNIX command input time.
UnixCommandTimeBetween DateTime Filter sessions that ran between a start and end time based on the UNIX command input time.
UnixOutput Text Filter sessions by using the UNIX terminal output text captured in the session.
User String Filter sessions by using the user name associated with the session.

CdaUnixCommand

Represents an indexed UNIX command captured in an audited session. The following properties are defined for this object.

Property Type Description
Command String Text of the UNIX command line that was executed.
Sequence Integer Sequence number that identifies where in the indexed list of events this event occurs.
Session CdaAuditSession The session object.
Time DateTime Date and time when the command was executed.

CdaUnixCommandTranscript

Represents the UNIX command input and output captured in an audited session. The following properties are defined for this object.

Property Type Description
EndTime DateTime The time at which the capture of this command ended.
LineNumber Integer The line number at which the text displayed in the terminal.
Role String The DirectAuthorize role assigned to this command.
Session CdaAuditSession The session object.
StartTime DateTime The time at which the capture of this command started.
Text String The text displayed in the terminal.
Ticket String The trouble ticket assigned to this command.
Type Enum Indicates whether the captured text was input or output.

CdaUserEvent

Represents a user event. The following properties are defined for this object.

Property Type Description
User String User name associated with the user event.
Machine String Computer name associated with the audit trail event.
Time DateTime The date and time when the command was executed.
Activity String A brief description of the user event.

CdaWindowsEvent

Represents an indexed Windows event captured in an audited session. The following properties are defined for this object.

Property Type Description
Application String Application name associated with the event.
Desktop String Desktop name associated with the event if the event occurred when using a desktop access right.
IsAudited Boolean Indicates whether this event occurred when using an audited role with a desktop right.
Sequence Integer Sequence number that identifies where in the indexed list of events this event occurs.
Time DateTime Date and time when the event occurred.
Title String Windows title bar text for the application when the event occurred.
Type Enum Type of event. The most common event types indicate when a new window or a new application starts or when the title of an existing windows changes.