Hi,
I have change auditor and Intrust in my infrastructure.Recently enterprise license purchased for both.
I found a article Intrust and Change auditor can be integrated.
some questions
1.) Intrust logs stored in repository
2) CA logs stored in SQL
How do i integrate both products. Do I need to newly deploy the setup for integrating
Since the storage of audit data is so very different between the products, the simplest integration point is probably "IT Security Search".
It's easiest to understand by way of an example:
Suppose you would like to see all the activities of an admin "Sally".
Once you have IT Security Search deployed, it has the ability to search through by the InTrust data and the Change Auditor data for all actions performed by Sally. So ITSS is essentially your integration point.
Is this a complete answer? It depends on your needs / use cases for the audit data you are collecting. - e.g. do you need to publish reports? do you need to take immediate action to "fix" or "undo" administrative actions? Both products offer these capabilities but in different ways.
Since the storage of audit data is so very different between the products, the simplest integration point is probably "IT Security Search".
It's easiest to understand by way of an example:
Suppose you would like to see all the activities of an admin "Sally".
Once you have IT Security Search deployed, it has the ability to search through by the InTrust data and the Change Auditor data for all actions performed by Sally. So ITSS is essentially your integration point.
Is this a complete answer? It depends on your needs / use cases for the audit data you are collecting. - e.g. do you need to publish reports? do you need to take immediate action to "fix" or "undo" administrative actions? Both products offer these capabilities but in different ways.
