Discover our industry leading expertise
Industry Insights
Resolving challenges with security audit reports
How does your top management assess the value of Security Audit reports to support their risk assurance?
Reporting on User Access in JD Edwards
Auditing changes within E1 can seem daunting! But you can easily audit your History Table for User, Role or Menu changes and identify what was done, when, by whom. Your auditors and going to love this!
Auditing changes within E1 can seem daunting!
Access Auditing Concepts
User access is changed when security related data is modified within a number of tables in JD Edwards (JDE) EnterpriseOne (E1).
The following E1 functions affect user access:
User Changes
Role Changes
Assignment Changes
Security Changes
Menu Changes
Audit Events
Once the ‘Security History’setting is enabledin JDE (for JDE events) and/or in ALLOut (for AO & JDE events), ‘Audit Events’ are recorded to the F9312 when specific actions occur.
The type of events that are recorded are stored in the UDC table:
User Record Changes
Role Record Changes
Assignment Changes
Security Changes
Menu Changes
What writes audit events?
Audit events are recorded in the F9312 by the following:
System functions – i.e. login/logout where the function event is recorded
Programs (that exist in the current PathCode) which write to system tables – e.g. P0092 writes to F0092 and the data change event is recorded
Programs (that exist in the current PathCode) which write to environment specific tables – e.g. PDIS0970 writes to F9000 and the data change event is recorded
Note
ALLOut programs check against the configuration of the UDC (AOS/QS) before writing to the F9312 – this depends on the configuration of the AOS program(s) involved.
- The AOS/QS table should not be modified as it is only used for internal AOS reference.
- Before writing to the F9312, each AOS program checks the environment specific UDC configuration
- Configuration settings have defaults in each environment so even if they have never been consciously configured they are still used.
- JDE programs do not check this UDC configuration – the code of each program determines what is written.
ALLOut Audit Reporting
ALLOut Audit Reporting has been designed to fulfil all access audit reporting requirements – this includes reporting on both standard E1 audit events and custom ALLOut events. The report can be tailored to
print only the required audit information.
For more information on Auditing your JDE History Table and designing your Audit reports, contact hazel.jackson@alloutsecurity.com
