fix(auditor/10.9): correct Azure Files permission display and exclusi…

docs/auditor/10.9/admin/monitoringplans/azurefiles.md

@@ -22,8 +22,8 @@ Create monitoring plans for Azure Files to track file and folder changes across
 1. In the **Netwrix Auditor**, go to **Home > Monitoring Plans > + Add Plan**
 2. Select **Azure Files**
 3. Configure:
- - [Audit database (SQL)](/docs/auditor/10_8/admin/settings/auditdatabase)
- - [Notifications (SMTP or Exchange Online)](/docs/auditor/10_8/admin/settings/notifications)
+ - [Audit database (SQL)](/docs/auditor/10.9/admin/settings/auditdatabase)
+ - [Notifications (SMTP or Exchange Online)](/docs/auditor/10.9/admin/settings/notifications)
  - Plan name and description
  - Select **Add item now**
 
@@ -49,32 +49,32 @@ Create monitoring plans for Azure Files to track file and folder changes across
 
    - **Read Access (Success/Fail)** → Track file reads and unauthorized read attempts
      - **Successful** - Show successful attempts to read files
-     - **Failed** - Use this option to track suspicious activity. Helps find out who was trying to access your private data without proper justification.Enabling this option on public shares will result in a high number of events generated on Azure Files and the amount of data written to the Long-Term Archive
+     - **Failed** - Use this option to detect unauthorized attempts to read your data. Enabling this option on public shares generates a high volume of events on Azure Files and increases the amount of data written to the Long-Term Archive
 
 **Note:** Enabling read access auditing on public shares may generate high event volume
 
 **Tip:** Only enable read auditing where compliance requires it (e.g., HR, Finance)
 
-4. Add exclusions → e.g., service accounts that produce excessive logs
-
-- **Monitored object types** - Select from:
+4. **Monitored object types** - Select from:
  - Files
  - Folders
  - Shares
-- **Monitored actions** - Configure which file operations to track
+5. **Monitored actions** - Configure which file operations to track
+6. **Collect data for state-in-time reports** – Enable this option to have Netwrix Auditor store periodic snapshots of your Azure Files permissions. State-in-Time reports, including permission and effective access reports, require these snapshots. See [Configuring State-in-Time Data Collection for Azure Files](/docs/auditor/10.9/configuration/azurefiles/stateintime.md) for the snapshot schedule, historical snapshot import, and optional Active Directory integration for on-premises accounts and groups.
+7. Click **Save**
+
+### Step 4: Configure Exclusions (optional)
 
-### Step 5: Test Connection
+What you can exclude depends on the monitored item type:
 
-Click **Test Connection** to verify:
-- Microsoft Entra ID authentication
-- Storage account access
-- Audit log collection
+- **Azure Subscription items** – On the item's **Scope** tab, exclude specific **storage accounts** or **resource groups** by name so Netwrix Auditor skips them entirely for this subscription.
+- **Azure Storage Account items** – On the item's **Scope** tab, use the **Omit List** to exclude specific shares, folders, or files (Universal Naming Convention (UNC) paths). Choose **All** to exclude an object from all data collection, **SiT** to exclude it from State-in-Time snapshots only, or **User Activity** to exclude it from activity data collection only. See [Configuring the monitoring scope (omit lists)](/docs/auditor/10.9/configuration/azurefiles/stateintime.md#configuring-the-monitoring-scope-omit-lists) for details.
 
 ## Next Steps
 
 After creating the monitoring plan:
 1. **Verify data collection** is working
-2. **[Configure reports](/docs/auditor/10_8/admin/reports/overview)** as needed
-3. **[Set up alerts](/docs/auditor/10_8/admin/alertsettings/create/)** for important events
+2. **[Configure reports](/docs/auditor/10.9/admin/reports/overview)** as needed
+3. **[Set up alerts](/docs/auditor/10.9/admin/alertsettings/create/)** for important events
 
 For configuration requirements, see [Azure Files Configuration](/docs/auditor/10.9/configuration/azurefiles/overview.md)

docs/auditor/10.9/admin/monitoringplans/useractivity/_category_.json

@@ -0,0 +1,10 @@
+{
+  "label": "User Activity",
+  "position": 180,
+  "collapsed": true,
+  "collapsible": true,
+  "link": {
+    "type": "doc",
+    "id": "overview"
+  }
+}

docs/auditor/10.9/admin/monitoringplans/useractivity/monitoredcomputers.md

@@ -0,0 +1,59 @@
+---
+title: "Monitored Computers"
+description: "Monitored Computers"
+sidebar_position: 20
+---
+
+# Monitored Computers
+
+The **Monitored Computers** tab in a User Activity monitoring plan gives you a detailed, per-host view of every monitored computer. Instead of showing a single summary status for the entire plan, the tab reports the health of each computer, so you can identify issues quickly and drill into diagnostic details without leaving the interface.
+
+**To access the Monitored Computers tab:**
+
+**Step 1** – In the main Netwrix Auditor menu, select **Monitoring Plans**.
+
+**Step 2** – Select your User Activity monitoring plan and click **Edit**.
+
+**Step 3** – Click **Edit Data Source** in the right pane, then select **Monitored Computers**.
+
+## Overview
+
+When you add computers to a monitoring plan using an IP range or an AD container, Netwrix Auditor resolves and tracks each host individually. The Monitored Computers tab lists all resolved computers with their current health status, so you can immediately see which hosts are collecting data normally and which ones require your attention.
+
+**NOTE:** The Monitored Computers tab doesn't display computers that you exclude from monitoring with the **Exclude these objects** or **Exclude subranges** setting in the item settings.
+
+![Monitored Computers tab with details for a selected computer](/images/auditor/10.9/admin/monitoringplans/useractivity/monitored-computers-details1.webp)
+
+## Monitored Computers Grid
+
+The grid displays the following columns for each computer:
+
+| Column | Description |
+|---|---|
+| **Name** | The hostname or IP address of the monitored computer. |
+| **Item** | The source that included this computer in the plan — for example, an IP address, an IP range, or an AD container (OU). |
+| **Status** | A consolidated status indicator for the computer. |
+| **Last Activity Time** | The timestamp of the last time the service interacted with the computer. |
+
+## Filtering and Search
+
+**Search field** — Enter text in the search field in the upper-right corner to filter the list of computers. The search matches entries in the **Name**, **Item**, and **Status** fields. It's case-insensitive and supports partial matches — for example, entering `old` returns computers whose **Name**, **Item**, or **Status** field contains that substring. Press **Enter** to refresh the results.
+
+**Filters** — Click **Filters** to open the Apply Filters dialog, where you can filter by:
+
+- **Status** — Select one or more statuses from the dropdown list to show only computers in those states.
+- **Name** — Enter a partial or full computer name.
+- **Items** — Select one or more items (IP ranges, OUs, or individual computers) from the dropdown list.
+
+![Apply Filters dialog showing Computer status, Computer name, and Item name options](/images/auditor/10.9/admin/monitoringplans/useractivity/monitored-computers-filter.webp)
+
+You can combine search and filters. The label next to **Filters** shows a summary of the active filters. To remove all active filters at once, click **Clear All** in the Filters dialog.
+
+## Exporting the List
+
+Click **Export** above the grid to save the displayed computers to a file. The export respects any active search term and filters, and includes the following columns: **Name**, **Item**, **Status**, and **Last Activity Time**.
+
+## Related Topics
+
+- [Monitoring Plans — User Activity](/docs/auditor/10.9/admin/monitoringplans/useractivity/overview.md)
+- [Add Items for Monitoring](/docs/auditor/10.9/admin/monitoringplans/datasources.md#add-items-for-monitoring)