Skip to main content

Supported Data Sources

This section lists platforms and systems that Netwrix Auditor can monitor.

Active Directory​

Auditor supports monitoring the following domain controller operating system versions:

  • Windows Server 2025
  • Windows Server 2022
  • Windows Server 2019
  • Windows Server 2016
  • Windows Server 2012 R2
  • Windows Server 2012

See the Active Directory topic for additional information.

Active Directory Federation Services (AD FS)​

Auditor supports monitoring the following AD FS operating system versions:

  • AD FS 5.0 – Windows Server 2019
  • AD FS 4.0 – Windows Server 2016
  • AD FS 3.0 – Windows Server 2012 R2

See the AD FS topic for additional information.

Azure Files​

Auditor supports monitoring Azure Files with the following requirements:

  • Azure Storage Account with File Shares (Server Message Block (SMB) protocol)
  • identity sources:
    • Active Directory Domain Services (AD DS)
    • Microsoft Entra Kerberos

See the Azure Files topic for additional information.

Exchange​

Auditor supports monitoring the following Exchange Server versions:

  • Microsoft Exchange Server 2019
  • Microsoft Exchange Server 2016
  • Microsoft Exchange Server 2013

See the Exchange topic for additional information.

File Servers​

Dell Data Storage​

Auditor supports monitoring the following device versions:

  • Dell Data Storage (Unity XT, UnityVSA) running any of the following operating environment versions:
    • 5.5.x
    • 5.4.x
    • 5.2.x
    • 5.0.x
    • 4.5.x
    • 4.4.x
  • Dell VNX/VNXe/Celerra families
  • Dell PowerStore family

NOTE: Netwrix Auditor supports only Common Internet File System (CIFS) configuration.

See the Dell Data Storage topic for additional information.

Dell Isilon/PowerScale​

Auditor supports monitoring the following device versions:

  • Dell Isilon/PowerScale versions 7.2 – 9.12

NOTE: Netwrix Auditor supports only CIFS configuration.

IMPORTANT: Netwrix Auditor does not support auditing of the System zone. Dell designates this zone for configuration access only. Store current data in other access zones.

See the Dell Isilon/PowerScale topic for additional information.

NetApp Data ONTAP​

Auditor supports monitoring the following device versions:

  • Clustered-Mode
    • 9.0 – 9.17
    • 8.3

NOTE: Netwrix Auditor supports only CIFS configuration.

See the NetApp Data ONTAP topic for additional information.

Nutanix​

Auditor supports monitoring the following device versions:

  • Files 3.6 - 5.2

See the Nutanix topic for additional information.

Qumulo​

Auditor supports monitoring the following device versions:

  • Core 3.3.5 - 6.x.x

See the Qumulo topic for additional information.

Synology​

Auditor supports monitoring the following device versions:

  • DiskStation Manager (DSM) 7.2.1
  • DSM 7.1
  • DSM 7.0
  • DSM 6.2.3

See the Synology topic for additional information.

Windows File Servers​

Auditor supports monitoring the following operating system versions:

  • Windows Server 2025

  • Windows Server 2022

  • Windows Server 2019

  • Windows Server 2016

  • Windows Server 2012 R2

  • Windows Server 2012

  • Windows 11

  • Windows 10 (32 and 64-bit)

  • Windows 8.1 (32 and 64-bit)

  • Windows 7 (32 and 64-bit)

See the Windows File Servers topic for additional information.

Group Policy​

Auditor supports monitoring the following domain controller operating system versions:

  • Windows Server 2025
  • Windows Server 2022
  • Windows Server 2019
  • Windows Server 2016
  • Windows Server 2012 R2
  • Windows Server 2012

See the Group Policy topic for additional information.

Logon Activity​

Auditor supports monitoring the following domain controller operating system versions:

  • Windows Server 2025
  • Windows Server 2022
  • Windows Server 2019
  • Windows Server 2016
  • Windows Server 2012 R2
  • Windows Server 2012

See the Logon Activity topic for additional information.

Microsoft 365​

Exchange Online

Auditor supports monitoring the following versions:

  • Exchange Online version provided within Microsoft Office 365
  • Microsoft GCC (government community cloud) and GCC High

NOTE: Netwrix Auditor does not support Department of Defense (DoD) tenant types.

See the Exchange Online topic for additional information.

Microsoft Entra ID (formerly Azure AD)

Auditor supports monitoring the following versions:

  • Microsoft Entra ID version provided within Microsoft Office 365
  • Microsoft GCC (government community cloud) and GCC High

NOTE: Netwrix Auditor does not support DoD tenant types.

See the Microsoft Entra ID (formerly Azure AD) topic for additional information.

Microsoft Teams (MS Teams)

Auditor supports monitoring the following versions:

  • Microsoft Entra ID version provided within Microsoft Office 365
  • Microsoft GCC (government community cloud) and GCC High

NOTE: Netwrix Auditor does not support DoD tenant types.

See the MS Teams topic for additional information.

SharePoint Online

Auditor supports monitoring the following versions:

  • SharePoint Online version provided within Microsoft Office 365
  • Microsoft GCC (government community cloud) and GCC High

NOTE: Netwrix Auditor does not support DoD tenant types.

See the SharePoint Online topic for additional information.

Network Devices​

Cisco ASA Devices

Auditor supports monitoring the following device versions:

  • ASA (Adaptive Security Appliance) 8 and above

See the Configure Cisco ASA Devices topic for additional information.

Cisco IOS Devices

Auditor supports monitoring the following device versions:

  • IOS (Internetwork Operating System) 12, 15, 16, and 17

See the Configure Cisco IOS Devices topic for additional information.

Cisco Meraki Dashboard

Auditor supports monitoring the following device versions:

  • Netwrix recommends the latest version of the Meraki Dashboard

See the Cisco Meraki Dashboard topic for additional information.

Cisco FTD

Auditor supports monitoring the following device versions:

  • FTD (Firepower Threat Defense) 6.5

Fortinet FortiGate Devices

Auditor supports monitoring the following device versions:

  • FortiOS 5.6 and above

See the Configure Fortinet FortiGate Devices topic for additional information.

HPE Aruba Devices

Auditor supports monitoring the following device versions:

  • Aruba OS 6.46.4.x – 8.6.0.x (Mobility Master, Mobility Controller)

See the Configure Pulse Secure Devices topic for additional information.

Juniper Devices

Auditor supports monitoring the following device versions:

  • vSRX with Junos OS 12.1, Junos OS 18.1, Junos OS 20.4R2
  • vMX with Junos OS 17.1

See the Configure Juniper Devices topic for additional information.

PaloAlto Devices

Auditor supports monitoring the following device versions:

  • PAN-OS 7.0, 8.0, 9.0, 10.0

See the Configure PaloAlto Devices topic for additional information.

Pulse Secure Devices

Auditor supports monitoring the following device versions:

  • 9.1R3 and above

See the Configure Pulse Secure Devices topic for additional information.

SonicWall Devices

Auditor supports monitoring the following device versions:

  • WAF 2.0.0.x / SMA v9.x & v10.x
  • NS 6.5.х.х with SonicOS 6.5.х and 7.0.x
  • SMA 12.2

See the Configure SonicWall Devices topic for additional information.

Oracle​

Auditor supports monitoring the following versions:

  • Database 23c On-Premise
  • Database 21c On-Premise
  • Database 19c On-Premise
  • Database 18c On-Premise
  • Database 12c On-Premise (12.1, 12.2)
  • Database 11g, limited support

See the Considerations for Oracle Database 11g topic for additional information.

  • Oracle Database Cloud Service (Enterprise Edition)

See the Oracle Database topic for additional information.

SharePoint​

Auditor supports monitoring the following versions:

  • Microsoft SharePoint Server Subscription Edition
  • Microsoft SharePoint Server 2019
  • Microsoft SharePoint Server 2016
  • Microsoft SharePoint Foundation 2013 and SharePoint Server 2013
  • Microsoft SharePoint Foundation 2010 and SharePoint Server 2010

See the SharePoint topic for additional information.

SQL Server​

Auditor supports monitoring the following versions:

  • Microsoft SQL Server 2025
  • Microsoft SQL Server 2022
  • Microsoft SQL Server 2019
  • Microsoft SQL Server 2017
  • Microsoft SQL Server 2016
  • Microsoft SQL Server 2014
  • Microsoft SQL Server 2012

NOTE: Netwrix Auditor does not support Linux-based versions.

See the SQL Server topic for additional information.

User Activity​

Auditor supports monitoring the following versions:

  • Windows Server 2025

  • Windows Server 2022

  • Windows Server 2019

  • Windows Server 2016

  • Windows Server 2012 R2

  • Windows Server 2012

  • Windows 11

  • Windows 10 (32 and 64-bit)

  • Windows 8.1 (32 and 64-bit)

  • Windows 7 (32 and 64-bit)

User Activity data source can support around 300 targets with one user session per target without scalability issues:

  • Depending on user activity density, the number may be higher for servers and lower for workstations.
  • 50-100 concurrent sessions per terminal server.

Netwrix recommends User Activity auditing only for sensitive or critical infrastructure areas. Applicable usage scenarios include, for example:

  • Terminal servers where users can log in from external locations
  • Areas accessible by contractor personnel
  • Servers with sensitive information
  • Sessions with elevated privileges

See the User Activity topic for additional information.

VMware Servers​

Auditor supports monitoring the following versions:

  • VMware ESX/ESXi: 6.0 – 6.7, 7.0, 8.0
  • VMware vCenter Server: 6.0 – 6.7, 7.0, 8.0

See the VMware topic for additional information.

Windows Servers​

Windows Servers & Desktops

Auditor supports monitoring the following operating system versions:

  • Windows Server 2025

  • Windows Server 2022

  • Windows Server 2019

  • Windows Server 2016

  • Windows Server 2012 R2

  • Windows Server 2012

  • Windows 11

  • Windows 10 (32 and 64-bit)

  • Windows 8.1 (32 and 64-bit)

  • Windows 7 (32 and 64-bit)

DNS & DHCP

Auditor supports monitoring the following operating system versions:

  • Windows Server 2025
  • Windows Server 2022
  • Windows Server 2019
  • Windows Server 2016
  • Windows Server 2012 R2
  • Windows Server 2012

NOTE: DNS support on Windows Server 2008 is limited to Windows Server 2008 SP2 (32 and 64-bit).

NOTE: Netwrix Auditor does not support DHCP on Windows Server 2008.

Internet Information Services (IIS)

Auditor supports monitoring the following operating system versions:

  • IIS 7.0 and above.

See the Windows Server topic for additional information.

Netwrix Integration API​

In addition to data sources monitored within the product, Auditor supports technology integrations leveraging its API. Download free add-ons from Netwrix Auditor Add-on Store to enrich your audit trails with activity from the following systems and applications.

Add-ons are also available to export data collected by Auditor to other systems (e.g., ArcSight and ServiceNow).

See the Integration API topic for additional information.