Systems and methods for monitoring messaging systems
View Patent ↗Systems and methods for monitoring and/or auditing of events in an electronic messaging environment, such as Microsoft® Exchange, are described. One or more monitoring components are installed on messaging system servers to collect, in real-time, information on messaging system events. Certain embodiments are configured to audit and/or provide alerts regarding non-owner activity, such as when a user or administrator has gained access to another user's mailbox. Alerts can advantageously facilitate prompt corrective action by delivering detailed information about the access activity, such as which email message or folder was accessed, when the access occurred, from what location (e.g., IP address) when the access was initiated, and the type of access, as well as permission changes made to the mailbox or folders. The monitoring systems can also be configured to audit changes to client permissions for folders and delegate assignment and/or changes to configuration objects of the messaging system.
1. A method for auditing messaging activity in an exchange server electronic messaging system, the method comprising:
automatically examining, in real-time, a plurality of messaging events generated during operation of an exchange server electronic messaging service, wherein the automatically examining is performed by adding a hook to the exchange server electronic messaging service, the hook executing in one or more computer processors, wherein the hook is configured to detect a request by a user to access a mailbox and to obtain data associated with the request;
detecting from the plurality of messaging events a request by a user to access a mailbox associated with the exchange server electronic messaging service;
obtaining data associated with the request wherein the data comprises a type of access performed by the user and an identify of the user;
comparing the identity of the user with an identity of the mailbox owner;
automatically determining whether the type of access performed by the user with respect to the mailbox is changing at least one permission of a folder associated with the mailbox; and
when the type of access is changing at least one folder permission, issuing an alert when the identity of the user is not the same as the identity of the mailbox owner, the alert reporting information on the particular mailbox accessed, the identity of the user, a path to the folder in the mailbox, a folder name, one or more new folder permission values, and one or more old folder permission values with respect to the mailbox.
2. The method of claim 1 , additionally comprising determining an internet protocol (IP) address of the user.
3. The method of claim 1 , wherein the adding the hook further comprises installing an interceptor module on at least one server executing the exchange server electronic messaging service.
4. The method of claim 1 , wherein said automatically examining comprises intercepting, with the interceptor module, data being transmitted to an exchange server electronic messaging store.
5. The method of claim 3 , additionally comprising accessing a rules engine on a management server remote to the at least one exchange server to determine which of the plurality of messaging events to intercept with the interceptor module.
6. The method of claim 1 , wherein said type of access comprises read access.
7. The method of claim 1 , wherein the user has administrator privileges with respect to the exchange server electronic messaging service.
8. The method of claim 1 , additionally comprising detecting configuration changes to the exchange server electronic messaging service.
9. The method of claim 8 , wherein said detecting configuration changes comprises monitoring a directory service installed on a domain controller.
10. A system for auditing user activity in an exchange server electronic messaging environment, the system comprising:
a monitoring component configured to execute on a server running an exchange server electronic messaging service, the monitoring component comprising:
an interceptor module configured to detect, in real-time, a call generated by a user to access a mailbox of the exchange server electronic messaging service, wherein the interceptor module comprises a hook added to the exchange server electronic messaging service, the hook executing in one or more computer processors, wherein the hook is configured to detect a request by a user to access a mailbox and to obtain data associated with the request, the data comprising at least a type of access performed by the user and an identity of the user,
a comparison module in communication with the interceptor module, the comparison module being configured to transmit a non-owner access event when the user is not the owner of the mailbox being accessed, and
an activity monitor configured to automatically determine whether the type of access associated with the call to access the mailbox is changing at least one permission of a folder associated with the mailbox; and
when the type of access is changing at least one folder permission, a user interface component in network communication with the monitoring component, the user interface component being configured to automatically generate an alert in response to the comparison module transmitting the non-owner access event, the alert comprising information indentifying the accessed mailbox, an identity of the user, a path to the folder in the mailbox, a folder name, one or more new folder permission values, and one or more old folder permission values with respect to the mailbox.
11. The system of claim 10 , wherein the hook is added to a native function of the exchange server electronic messaging service.
12. The system of claim 11 , wherein the native function comprises a JetRetrieveColumns function.
13. The system of claim 10 , further comprising a management component coupling the user interface component to the monitoring component, the management component being configured to instruct the monitoring component to compile one or more logs identifying messaging activity of interest.
14. The system of claim 13 , wherein the monitoring component, the user interface component and the management component are each installed on different server computers that are remotely coupled through a network.
15. The system of claim 13 , further comprising a second monitoring component in communication with the management component and configured to detect changes to permissions to at least one mailbox of the exchange server electronic messaging service.
16. The system of claim 15 , wherein the second monitoring component is installed on a domain controller and is configured to monitor a directory service on the domain controller.
17. The system of claim 10 , wherein the monitoring component comprises a plug-in module.
18. The system of claim 10 , wherein the alert comprises an email message.
19. A system for auditing activity in an exchange server electronic messaging service, the system comprising:
means for automatically examining, in real-time, messaging events generated during operation of an exchange server electronic messaging service, wherein the means for automatically examining comprises a hook added to the exchange server electronic messaging service, the hook executing in one or more computer processors, wherein the hook is configured to detect a request by a user to access a mailbox and to obtain data associated with the request;
means for detecting from the messaging events a request by a user to access a mailbox associated with the exchange server electronic messaging service;
means for obtaining data associated with the request wherein the data comprises a type of access performed by the user and an identify of the user;
means for comparing the identity of the user with an identity of the mailbox owner;
means for automatically determining whether the type of access performed by the user with respect to the mailbox is changing at least one permission of a folder associated with the mailbox; and
when the type of access is changing at least one folder permission, means for issuing an alert when the identity of the user is not the same as the identity of the mailbox owner, the alert reporting information on the mailbox accessed, the identity of the user, a path to the folder in the mailbox, a folder name, one or more new folder permission values, and one or more old folder permission values with respect to the mailbox.