Skip to content

Define Environments

The Define module is the foundation of LT Auditor MP. Before any audit data can be collected, filtered, or reported on, you must first define the environments and log categories that describe where your data comes from and how it is structured. Everything else in the platform — receivers, filters, reports, views, and compliance rules — references the environments and categories defined here.

Understanding environments and categories:

Environments represent the operating systems or platforms from which audit logs are collected. Examples include:

  • Windows
  • Ubuntu
  • Red Hat
  • SUSE
  • OpenText

Log Categories define the types of audit events collected within an environment — for example, Authentication, File Access, or System Events. Each category defines:

  • The specific operations that are auditable within it
  • The data columns stored for each event in that category
  • The structure that filters, reports, and views use to work with the data

Accessing the Define module:

  1. Log in to the LT Auditor MP web portal
  2. Navigate to Define in the main navigation menu
  3. The Define page displays all configured environments with their associated log categories

Creating an environment:

Requires createDefine permission.

  1. Navigate to the Define page
  2. Click Add Environment
  3. Fill in the environment details:
Field Description
Name A descriptive name for the environment (e.g., Windows Servers, Ubuntu Systems)
Key A unique identifier used internally (e.g., windows, ubuntu) — no spaces
Description Optional description of the environment’s purpose and scope
Group A categorization label for organizing environments
  1. Click Save

Managing log categories:

Each environment can contain multiple log categories defining the types of audit events collected within it.

Creating a category:

  1. Select an environment from the environment list
  2. Click Add Category
  3. Configure the category details:
Field Description
Name Display name for the category (e.g., Authentication Logs, File Access)
Key Unique identifier (e.g., auth, file-access) — no spaces
Description Purpose and scope of this category
  1. Navigate to the Operations section and define which operations are auditable within this category — see the Operations section below
  2. Navigate to Log Table Columns and define the data fields stored for events in this category:
Column Setting Description
Column Name Field name in the database
Display Name User-friendly name shown in views and reports
Data Type String, Number, Date, Boolean, etc.
Default Column Mark if this field should appear in default views
  1. Click Save

Define all necessary columns upfront where possible. Changes to column definitions after data has been collected may affect existing filters, reports, and views that depend on those columns.

Importing categories:

If pre-configured category definitions are available as JSON files they can be imported rather than created manually:

  1. Click Import
  2. Select the JSON file containing category definitions
  3. Review the imported configuration
  4. Click Save to apply

[Your administrator should confirm whether pre-configured category import files are available for your deployment from Blue Lance or your internal configuration library.]

Editing a category:

  1. Select the environment containing the category
  2. Click the Edit icon next to the category
  3. Modify the necessary fields
  4. Click Save

Changes to categories may affect existing filters and reports that depend on them. Review active filters and reports after making significant category changes.

Deleting a category:

Requires deleteDefine permission. Deleting a category removes all associated audit filters and may impact existing reports. This action cannot be undone.

  1. Select the category to delete
  2. Click the Delete icon
  3. Confirm the deletion

Operations management:

Operations represent specific actions that can be audited within a category — for example Login, Logout, File Read, or File Write. Operations are defined when creating or editing a category.

Defining operations:

  1. When creating or editing a category navigate to the Operations section
  2. Select operations from the available list or create custom operations
  3. Configure operation metadata:
Field Description
Operation Name Descriptive name for the operation (e.g., User Login, File Delete)
Operation Code Unique identifier for the operation
Severity Level Critical, High, Medium, or Low
  1. Save the configuration

Operations defined here become available for selection when creating audit filters, reports, and compliance rules.

Best practices:

  • Use clear consistent naming conventions for environments and categories so other administrators understand their purpose without needing to open the configuration
  • Define all necessary log table columns upfront before data collection begins to avoid schema changes later
  • Add descriptions to all environments and categories to help other users understand their purpose
  • Use sample logs to verify your environment and category definitions before deploying receivers to production
  • Avoid deleting categories that have active filters, reports, or compliance rules referencing them — disable collection instead until references are updated

[Your administrator should document all configured environments and categories and review them whenever new collection modules are added to the environment or compliance requirements change.]