Configure a third party audit service providers for security auditing

The audit service provider is used to format the audit data object that was sent by the audit event factory. In addition to the default audit service provider, you may use a third party implementation as our audit service provider.

Before configuring the audit service provider, enable global security in the environment.

This task configures the audit service provider used to record generated audit records.

Tasks

1. Click Security > Security Auditing > Audit service provider.

2. Click New and then select Third party emitter.

3. Enter the unique name that should be associated with this audit service provider in the Name field.

4. Enter the Third party emitter class name.

5. Enter the Event formatting module class name. This field specifies the class used to format the generic event into a format that is specific to the audit service provider implementation. For example, your implementation might have an event formatting class that takes the generic event and translates it into XML data.

6. Select the filters to be used by this audit service provider. The Selectable filter list consists of a list of the configured filters that have been configured and are currently enabled.

   1. Select the filters that should be audited from the Selectable filter list.

   2. Click Add >> to add the selected filters to the Enabled filter list.

7. Optional: Enter any custom properties that you included in your third party emitter code.

8. Click Apply.

After completing these steps, our audit data will be sent to the specified repository in the format required by that repository.

What to do next

After creating an audit service provider, the audit service provider must be associated with an audit event factory provide the audit data objects to the audit service provider. Next we should configure an audit event factory.

Subtopics

• Example: Base Generic Emitter Interface
  The Base Generic Emitter interface defines how audit events are emitted. Other interfaces can exist to extend this interface and to process specific audit events groupings, such as security events, transactional events, or some other custom grouping. Use this interface to create a custom implementation of the emitter.

Auditing the security infrastructure

Configure auditable events using scripting

Audit service provider collection

Audit service provider settings