Host Security Profile Change Tracking

This report helps you keep an eye on configuration changes that were made in security profiles of your vSphere hosts across a time range.

Description

The Host Security Profile Change Tracking report analyzes host security profile configuration changes, provides detailed information on changes performed within the reporting period and helps track the most frequently changed properties.

Parameters

Date/time Selection: defines the time period to analyze in the report.

Scope: defines a list of Groups or Objects that will be analyzed in the report. By default, the VMware Security Profile Group is selected. This group includes security profiles on vSphere hosts.
The Add Group option returns a Group and all objects that a group contains. The Add Object option returns only the selected object.

Aggregation Type: defines whether the data in the report will be aggregated to Hourly or Daily values.

Group changes by: defines how data will be grouped in the report (by Property or Date).

Order objects by: defines how data will be sorted in the report (by Name or Number of changes).

Sample Usage

Track host security profile changes applied to a specific vSphere host during the previous week.

Instructions

1. Open the Host Security Profile Change Tracking report.
2. From the From list, select Previous week > Monday. From the To list, select Previous week > Friday.
3. In the Scope section, select VMware Security Profile Group and click Remove. Then search for the necessary host to include in the report. Click Add Group. In the Group Name search box, enter the name of the host and click Search. In the list of search results, select the object that belongs to the VMware vSphere Host class, click Add and click OK.
4. In the Properties field, select all properties.
5. From the Group changes by list, select Property.
6. From the Group objects by list, select Name.
7. Click Run to view the report.

Report Output

In the Summary section, the report will display the Top 5 most changing properties chart with 5 most frequently changed properties.

The details section will provide the following information for each host included in the report scope:

For each registered property change, the report will also provide the date of change, old and new property values.

You can click the Total number of changes link or the date of the change to drill down to the Microsoft Custom Event report:

• If you click the Total number of changes link, the Custom Event report will display all events for the object for the selected time interval.
• If you click the date of change, the Custom Event report will display events for the day previous to the time stamp.

The Custom Event report will provide information on the date and time of the change and the user who changed configuration. If you want to include more parameters in the report, click the Show or Hide Parameter Area button to open the report parameters and include more options in the Report Fields.