Fix misleading automatic-config claim in network device docs

[TheNewCat777]

Cisco ASA, Cisco IOS, Fortinet FortiGate, Juniper, PaloAlto, and SonicWall device docs presented a choice between configuring native audit settings 'Automatically through a monitoring plan' or manually. In practice, Netwrix Auditor cannot push audit configuration to these network devices - settings must always be configured manually on the device itself. Removed the misleading automatic-configuration option and reworded the intro to state plainly that configuration is manual, matching the existing HPE Aruba and Cisco Meraki docs.

Applied to Auditor 10.7, 10.8, and 10.9.

[github-actions]

Auto-Fix Summary

114 issues fixed, 18 skipped across 18 files

Category	Fixes
Contractions	9
Removed filler	6
Substitutions	9
FollowTheStepsTo (rewrite)	6
OxfordComma (rewrite)	18
Dale: misplaced-modifiers	6
Dale: passive-voice	54
Dale: positional-references	3
Dale: undefined-acronyms	3

Skipped (needs manual review)	Reason
docs/auditor/10.7/configuration/networkdevices/sonicwall.md:114 — Netwrix.Plurals	'HTTP(S)' is part of a verbatim SonicWall log message string ('HTTP(S) Cache settings were updated') in the collected-actions table. Rewording would misrepresent the literal text the device emits and Auditor matches on.
docs/auditor/10.8/configuration/networkdevices/sonicwall.md:114 — Netwrix.Plurals	'HTTP(S)' is part of a verbatim SonicWall log message string ('HTTP(S) Cache settings were updated') in the collected-actions table. Rewording would misrepresent the literal text the device emits and Auditor matches on.
docs/auditor/10.9/configuration/networkdevices/sonicwall.md:114 — Netwrix.Plurals	'HTTP(S)' is part of a verbatim SonicWall log message string ('HTTP(S) Cache settings were updated') in the collected-actions table. Rewording would misrepresent the literal text the device emits and Auditor matches on.
docs/auditor/10.7/configuration/networkdevices/ciscoasa.md:9 — Dale: wordiness	The opening paragraph is boilerplate repeated verbatim across every Auditor configuration topic; condensing it here only would diverge from the rest of the product docs
docs/auditor/10.8/configuration/networkdevices/ciscoasa.md:9 — Dale: wordiness	The opening paragraph is boilerplate repeated verbatim across every Auditor configuration topic; condensing it here only would diverge from the rest of the product docs
docs/auditor/10.9/configuration/networkdevices/ciscoasa.md:9 — Dale: wordiness	The opening paragraph is boilerplate repeated verbatim across every Auditor configuration topic; condensing it here only would diverge from the rest of the product docs
docs/auditor/10.7/configuration/networkdevices/ciscoios.md:9 — Dale: wordiness	Shared boilerplate opening paragraph; rewriting it in one topic only would create inconsistency across the product docs
docs/auditor/10.8/configuration/networkdevices/ciscoios.md:9 — Dale: wordiness	Shared boilerplate opening paragraph; rewriting it in one topic only would create inconsistency across the product docs
docs/auditor/10.9/configuration/networkdevices/ciscoios.md:9 — Dale: wordiness	Shared boilerplate opening paragraph; rewriting it in one topic only would create inconsistency across the product docs
docs/auditor/10.7/configuration/networkdevices/fortinetfortigate.md:27 — Dale: positional-references	The two bullets duplicate the labels of the two procedures that follow, but those labels are plain paragraphs rather than Markdown headings, so there is no valid anchor to link to; converting them would require restructuring the topic
docs/auditor/10.8/configuration/networkdevices/fortinetfortigate.md:27 — Dale: positional-references	The two bullets duplicate the labels of the two procedures that follow, but those labels are plain paragraphs rather than Markdown headings, so there is no valid anchor to link to; converting them would require restructuring the topic
docs/auditor/10.9/configuration/networkdevices/fortinetfortigate.md:27 — Dale: positional-references	The two bullets duplicate the labels of the two procedures that follow, but those labels are plain paragraphs rather than Markdown headings, so there is no valid anchor to link to; converting them would require restructuring the topic
docs/auditor/10.7/configuration/networkdevices/juniper.md:43 — Dale: passive-voice	'(514 port used by default)' is a conventional reduced-relative parenthetical; rewriting it risks changing which port the sentence describes
docs/auditor/10.8/configuration/networkdevices/juniper.md:43 — Dale: passive-voice	'(514 port used by default)' is a conventional reduced-relative parenthetical; rewriting it risks changing which port the sentence describes
docs/auditor/10.9/configuration/networkdevices/juniper.md:43 — Dale: passive-voice	'(514 port used by default)' is a conventional reduced-relative parenthetical; rewriting it risks changing which port the sentence describes
docs/auditor/10.7/configuration/networkdevices/sonicwall.md:92 — Dale: misplaced-modifiers	'In the dialog appears, select Create new address object option in the Name or IP Address combo box' is garbled; the intended UI flow is ambiguous, so any rewrite risks changing the instruction
docs/auditor/10.8/configuration/networkdevices/sonicwall.md:92 — Dale: misplaced-modifiers	'In the dialog appears, select Create new address object option in the Name or IP Address combo box' is garbled; the intended UI flow is ambiguous, so any rewrite risks changing the instruction
docs/auditor/10.9/configuration/networkdevices/sonicwall.md:92 — Dale: misplaced-modifiers	'In the dialog appears, select Create new address object option in the Name or IP Address combo box' is garbled; the intended UI flow is ambiguous, so any rewrite risks changing the instruction

Ask @claude on this PR if you'd like an explanation of any fix.

[github-actions]

Auto-Fix Summary

6 issues fixed, 9 skipped across 18 files

Category	Fixes
Dale: passive-voice	3
Dale: wordiness	3

Skipped (needs manual review)	Reason
docs/auditor/10.7/configuration/networkdevices/sonicwall.md:112 — Netwrix.Plurals	'HTTP(S)' is part of a verbatim SonicWall event message string ('HTTP(S) Cache settings were updated') in a reference table of event text Netwrix Auditor matches on. Rewriting it would make the documented event string inaccurate.
docs/auditor/10.8/configuration/networkdevices/sonicwall.md:112 — Netwrix.Plurals	'HTTP(S)' is part of a verbatim SonicWall event message string ('HTTP(S) Cache settings were updated') in a reference table of event text Netwrix Auditor matches on. Rewriting it would make the documented event string inaccurate.
docs/auditor/10.9/configuration/networkdevices/sonicwall.md:112 — Netwrix.Plurals	'HTTP(S)' is part of a verbatim SonicWall event message string ('HTTP(S) Cache settings were updated') in a reference table of event text Netwrix Auditor matches on. Rewriting it would make the documented event string inaccurate.
docs/auditor/10.7/configuration/networkdevices/ciscoasa.md:9 — Dale: wordiness	The intro paragraph ("requires a certain configuration of native audit settings in the audited environment") is site-wide boilerplate appearing in 120 files. Rewriting it in only these 18 files would break consistency across the Auditor configuration docs. Same paragraph occurs at line 9 of all 18 changed files.
docs/auditor/10.7/configuration/networkdevices/ciscoasa.md:14 — Dale: passive-voice	"the folder associated with Netwrix Auditor" is a reduced passive inside the shared CAUTION boilerplate used across many Auditor docs; changing it only here would diverge from the rest of the set. Same line occurs in all 18 changed files.
docs/auditor/10.7/configuration/networkdevices/juniper.md:40 — Dale: passive-voice	"the UDP port used to listen to network devices (514 port used by default)" is repeated boilerplate in juniper, paloalto, and sonicwall tables across all three versions. Rewriting to active voice requires deciding who does the listening and whether "name" should be "number" — a content decision, not a confident style fix.
docs/auditor/10.7/configuration/networkdevices/ciscoasa.md:18 — Dale: wordiness	The summary bullet list at lines 21-29 restates the numbered procedure at lines 31-63. Collapsing the duplication is a structural/content decision beyond a sentence-level wordiness fix. Same pattern in ciscoios.md and fortinetfortigate.md across all three versions.
docs/auditor/10.7/configuration/networkdevices/fortinetfortigate.md:21 — Dale: wordiness	"enable logging to multiple Syslog servers and configure FortiOS to send log messages to remote syslog servers" reads redundantly, but "multiple Syslog servers" appears to be a FortiGate feature name, so condensing risks losing technical meaning. Same line in all three versions.
docs/auditor/10.7/configuration/networkdevices/sonicwall.md:19 — Dale: wordiness	"Configure log settings, depending on your device type." followed by "To configure your SonicWall devices, do the following:" is mildly redundant, but the second line introduces three device-specific procedures, so removing either sentence could obscure the structure. Same lines in all three versions.

Ask @claude on this PR if you'd like an explanation of any fix.

[TheNewCat777]

@claude fix all issues

[github-actions]

Fix in progress:

• ciscoasa.md — explain why config is manual; reframe the required-settings list as end state; resolve the duplicated NOTE
• ciscoios.md — same intro fix; name Netwrix Auditor Server in the logging host bullet; reframe list
• fortinetfortigate.md — drop the CLI-only claim that contradicts the two-method choice below it
• juniper.md — "Junos OS command line interface (CLI)"; rewrite the preamble that restated step 1
• paloalto.md — article fix for "web interface"; normalize "syslog server profile"; "Palo Alto device"
• sonicwall.md — revert the 4 altered verbatim device event strings; fix the double "Configure" intro; restore table row padding
• Replicate all changes to 10.8 and 10.9
• Commit and push

[github-actions]

Fix in progress:

• Restore verbatim SonicWall event strings and table row formatting (sonicwall.md, 3 versions)
• ciscoasa.md — explain why config is manual; reframe list as required end state; de-duplicate the EMBLEM note
• ciscoios.md — same intro/list fixes; name Netwrix Auditor Server instead of "the service"
• fortinetfortigate.md — CLI-only claim contradicts the two-method choice below it
• juniper.md — "Junos OS command line interface (CLI)"; rewrite the preamble that restated step 1
• paloalto.md — drop duplicated intro clause; normalize "syslog server profile"; "Palo Alto device"; article fix
• sonicwall.md — fix the double "Configure" intro
• Replicate to 10.8 and 10.9, verify, commit, and push

[github-actions]

Auto-Fix Summary

33 issues fixed, 7 skipped across 18 files

Category	Fixes
Contractions	3
Removed filler	6
Substitutions	3
Dale: misplaced-modifiers	12
Dale: passive-voice	9

Skipped (needs manual review)	Reason
docs/auditor/10.7/configuration/networkdevices/sonicwall.md:111 — Netwrix.Plurals	'HTTP(S)' is part of a verbatim SonicWall event message string ('HTTP(S) Cache settings were updated') in the Event ID reference table. Rewriting it would break the literal string readers match against device logs.
docs/auditor/10.8/configuration/networkdevices/sonicwall.md:111 — Netwrix.Plurals	'HTTP(S)' is part of a verbatim SonicWall event message string ('HTTP(S) Cache settings were updated') in the Event ID reference table. Rewriting it would break the literal string readers match against device logs.
docs/auditor/10.9/configuration/networkdevices/sonicwall.md:111 — Netwrix.Plurals	'HTTP(S)' is part of a verbatim SonicWall event message string ('HTTP(S) Cache settings were updated') in the Event ID reference table. Rewriting it would break the literal string readers match against device logs.
docs/auditor/10.7/configuration/networkdevices/ciscoasa.md:21 — Dale: passive-voice	'The global configuration mode is enabled', 'The logging enable option is turned on', and 'The logging timestamp option is enabled' (lines 21, 22, 28) describe the device's end state under the stem 'the device has the following settings'. 'enabled'/'turned on' read as predicative adjectives; an agentive active rewrite would have to invent a subject. Same pattern skipped in ciscoios.md lines 21-22 and in the 10.8/10.9 copies.
docs/auditor/10.7/configuration/networkdevices/ciscoasa.md:10 — Dale: wordiness	'requires a certain configuration of native audit settings in the audited environment' is shared intro boilerplate repeated verbatim across every Auditor configuration page; tightening it in only these 18 files would diverge from the rest of the product. Same skip applies to the identical paragraph in all 18 changed files.
docs/auditor/10.7/configuration/networkdevices/paloalto.md:38 — Dale: passive-voice	'the UDP port used to listen to network devices (514 port used by default)' appears inside an aligned Markdown table cell; rewriting would require reflowing the column padding and would diverge from the identical cells used elsewhere in the Auditor docs. Same skip for sonicwall.md lines 36 and 63 in all three versions.
docs/auditor/10.7/configuration/networkdevices/sonicwall.md:89 — Dale: misplaced-modifiers	'In the dialog appears, select Create new address object option' is missing a relative pronoun ('the dialog that appears') and an article. This is a grammar/content defect rather than a Dale rule violation, so it is left for the editorial reviewer. Present in all three versions.

Ask @claude on this PR if you'd like an explanation of any fix.

[github-actions]

Documentation PR Review

Editorial Review

This PR applies the same six file changes across three versions (10.7, 10.8, 10.9). The files are byte-identical per version except for the version number in the Juniper cross-reference link, and line numbers match across all three. Findings are listed once per unique file and apply to all three versions of that file.

docs/auditor/{10.7,10.8,10.9}/configuration/networkdevices/ciscoasa.md

• Clarity — Line 23: the new bullet says the logging host parameter is "set to the host address of the audited Cisco ASA device," but step 4 (line 45) tells the reader to set it to the IP address of the computer that hosts Netwrix Auditor Server. The summary and the procedure now contradict each other, and a reader who trusts the summary will point the device's syslog output at itself. The parallel bullet in ciscoios.md was corrected in this PR — the ASA one was missed. Suggested fix: "The logging host parameter is set to the host address of the computer that hosts Netwrix Auditor Server, using a UDP port (for example, 514) to send messages."
• Structure — Line 26: the EMBLEM format NOTE was deleted from step 4 (old line 68) and now appears only in the pre-procedure summary list. A reader working through the numbered steps hits the logging host command with no warning at the point of action. Suggested fix: restore the note under step 4 as an indented **NOTE:** Don't select the EMBLEM format logging for the syslog server option. — the summary bullet can stay, since it describes end state.
• Clarity — Line 46: step 4 uses "e.g., 514 UDP port" while the summary bullet you added at line 24 uses "for example, 514". Same page, same fact, two conventions. Suggested fix: "and ensure that the device uses a UDP port to send syslog messages (for example, port 514)."

docs/auditor/{10.7,10.8,10.9}/configuration/networkdevices/ciscoios.md

• Clarity — Line 43: step 5 refers to "the logging host parameter" as plain text, while the bullet you added at line 24 formats it as logging host code. Suggested fix: "Set the IP address of the Netwrix Auditor Server as the logging host parameter, and ensure that the device uses a UDP port to send syslog messages (for example, port 514)." — this also resolves the same e.g. inconsistency noted for Cisco ASA.

docs/auditor/{10.7,10.8,10.9}/configuration/networkdevices/fortinetfortigate.md

• Structure — Line 18: the six pages in this PR now open with two different rationales for manual configuration. Cisco ASA and Cisco IOS say "Netwrix Auditor can't push configuration changes to network devices, so configure native audit settings manually…"; FortiGate, Juniper, PaloAlto, and SonicWall say "Configure native audit settings manually on the X device to ensure Netwrix Auditor collects comprehensive and reliable audit data." These are sibling pages a reader moves between, and the "why" only appears on two of them. Suggested fix: use the Cisco phrasing on all six — it answers the reader's question ("why isn't this automatic like my other data sources?") instead of restating the instruction.
• Clarity — Lines 18–19: the new paragraph ("Configure native audit settings manually on the Fortinet FortiGate device to ensure Netwrix Auditor collects comprehensive and reliable audit data.") is immediately followed by "To configure your Fortinet FortiGate devices, enable logging to multiple Syslog servers…" — two consecutive sentences that both announce configuring FortiGate devices. Suggested fix: merge them, e.g. "Netwrix Auditor can't push configuration changes to network devices, so configure native audit settings manually on the Fortinet FortiGate device: enable logging to multiple syslog servers and configure FortiOS to send log messages to remote syslog servers in Common Event Format (CEF)."
• Completeness — Lines 22–23: "Do one of the following:" introduces two bullets (lines 25–26) that are plain text, not links, and the procedures they name (lines 28 and 53) are plain paragraphs rather than headings — so the reader has nothing to click and no visible section break to scan for. paloalto.md got real ## headings plus an anchor link in this PR; FortiGate has the same problem and didn't. Suggested fix: convert lines 28 and 53 to ## Configure Fortinet FortiGate devices via the command line interface and ## Configure Fortinet FortiGate devices through the Fortigate Management Console, then turn the bullets into anchor links.
• Clarity — Line 22: "remote syslog servers" (lowercase) sits in the same sentence as "multiple Syslog servers" (capitalized) from line 21. Suggested fix: lowercase both — "enable logging to multiple syslog servers".

docs/auditor/{10.7,10.8,10.9}/configuration/networkdevices/juniper.md

• Clarity — Line 40: the explanation defines <port number>, but the command it explains (line 32) uses the placeholder <port name>, and the added text still calls it "the name of the UDP port." A port is identified by a number, so "name" is wrong in both places. Suggested fix: change the command to # set system syslog host <host address> port <port number> and the explanation to "<port number> is the UDP port that Netwrix Auditor uses to listen to network devices (port 514 by default)."
• Completeness — Line 41: the [Network Devices](…) link is appended bare to the end of the sentence with no lead-in, so the reader can't tell what they'd find there or why they should go. Suggested fix: "For information about setting this port in a monitoring plan, see Network Devices." (adjust the version path per file).

docs/auditor/{10.7,10.8,10.9}/configuration/networkdevices/paloalto.md

• Completeness — Line 54: the NOTE refers to "the monitoring plan," but this PR removed the intro bullet that was the page's only other mention of monitoring plans, so the term now appears once, undefined, at the very end of the procedure. The reader is left asking which monitoring plan and where to configure it. Suggested fix: link it — "After you configure the monitoring plan, Netwrix Auditor listens to the logs that the Palo Alto device forwards." (adjust the version path per file).
• Consistency — Lines 18 and 55: the new body text uses "Palo Alto" (the correct vendor spelling), while the frontmatter title, H1, and the ## PaloAlto Devices heading still use "PaloAlto." The page now spells the product two ways. Suggested fix: standardize on "Palo Alto" and update the title, description, H1, and reference-section heading in the same pass — or keep "PaloAlto" in the added lines if the heading changes are deliberately out of scope.
• Clarity — Line 49: "click Add" is unbolded, while Device, Log Settings, and Commit elsewhere in the same procedure are bolded. Suggested fix: "On the syslog panel, click Add and select the syslog server profile you created in Configure a syslog server profile."

docs/auditor/{10.7,10.8,10.9}/configuration/networkdevices/sonicwall.md

• Structure — Line 19: "Adjust the log settings for your device type" tells the reader to find the procedure matching their device, but the three procedures that follow (lines 23, 50, 77 — Web Application Firewall, SMA, NS series) are plain paragraphs, not headings. They don't appear in the table of contents, can't be linked to, and are hard to distinguish from surrounding text on a page this long. Suggested fix: convert those three lines to ## Configure SonicWall Web Application Firewall, ## Configure SonicWall SMA, and ## Configure SonicWall NS series, and drop the now-redundant "To configure your SonicWall devices, do the following:" on line 21.

Summary

12 editorial suggestions across 6 unique files (18 files total, since each change is duplicated across versions 10.7, 10.8, and 10.9). The highest-priority item is the logging host contradiction in ciscoasa.md line 23, which would send a reader in the wrong direction. Vale and Dale issues are auto-fixed separately.

---

What to do next:

Comment @claude on this PR followed by your instructions to get help:

• @claude fix all issues — fix all editorial issues
• @claude help improve the flow of this document — get writing assistance
• @claude explain the voice issues — understand why something was flagged

You can ask Claude anything about the review or about Netwrix writing standards.

Automated fixes are only available for branches in this repository, not forks.

[github-actions]

Auto-Fix Summary

27 issues fixed, 16 skipped across 18 files

Category	Fixes
Contractions	3
Removed filler	6
Substitutions	3
Dale: misplaced-modifiers	6
Dale: passive-voice	9

Skipped (needs manual review)	Reason
docs/auditor/10.7/configuration/networkdevices/sonicwall.md:111 — Netwrix.Plurals	'HTTP(S)' is part of the verbatim SonicWall event message string 'HTTP(S) Cache settings were updated' in the event-ID reference table. Rewriting it would make the documented event string inaccurate.
docs/auditor/10.8/configuration/networkdevices/sonicwall.md:111 — Netwrix.Plurals	'HTTP(S)' is part of the verbatim SonicWall event message string 'HTTP(S) Cache settings were updated' in the event-ID reference table. Rewriting it would make the documented event string inaccurate.
docs/auditor/10.9/configuration/networkdevices/sonicwall.md:111 — Netwrix.Plurals	'HTTP(S)' is part of the verbatim SonicWall event message string 'HTTP(S) Cache settings were updated' in the event-ID reference table. Rewriting it would make the documented event string inaccurate.
docs/auditor/10.7/configuration/networkdevices/ciscoasa.md:21 — Dale: passive-voice	Stative passive in the 'When you finish, the device has the following settings:' checklist ('is enabled', 'is turned on', 'is set to'). Converting to active would require reframing the list as imperative steps, which duplicates the numbered procedure below it and changes the section from an end-state checklist to a second procedure.
docs/auditor/10.8/configuration/networkdevices/ciscoasa.md:21 — Dale: passive-voice	Same stative-passive end-state checklist as 10.7; reframing would change the section's meaning.
docs/auditor/10.9/configuration/networkdevices/ciscoasa.md:21 — Dale: passive-voice	Same stative-passive end-state checklist as 10.7; reframing would change the section's meaning.
docs/auditor/10.7/configuration/networkdevices/ciscoios.md:21 — Dale: passive-voice	Stative passive in the 'When you finish, the device has the following settings:' checklist; reframing as imperative steps would duplicate the numbered procedure that follows.
docs/auditor/10.8/configuration/networkdevices/ciscoios.md:21 — Dale: passive-voice	Same stative-passive end-state checklist as 10.7; reframing would change the section's meaning.
docs/auditor/10.9/configuration/networkdevices/ciscoios.md:21 — Dale: passive-voice	Same stative-passive end-state checklist as 10.7; reframing would change the section's meaning.
docs/auditor/10.7/configuration/networkdevices/ciscoasa.md:10 — Dale: wordiness	'requires a certain configuration of native audit settings in the audited environment' is verbose, but this intro paragraph is verbatim boilerplate shared across hundreds of Netwrix Auditor pages. Rewriting it only in the six changed files would break site-wide consistency; it needs a coordinated global change.
docs/auditor/10.7/configuration/networkdevices/ciscoios.md:10 — Dale: wordiness	Same shared boilerplate intro paragraph; skipped for site-wide consistency.
docs/auditor/10.7/configuration/networkdevices/fortinetfortigate.md:10 — Dale: wordiness	Same shared boilerplate intro paragraph; skipped for site-wide consistency.
docs/auditor/10.7/configuration/networkdevices/juniper.md:10 — Dale: wordiness	Same shared boilerplate intro paragraph; skipped for site-wide consistency.
docs/auditor/10.7/configuration/networkdevices/paloalto.md:10 — Dale: wordiness	Same shared boilerplate intro paragraph; skipped for site-wide consistency.
docs/auditor/10.7/configuration/networkdevices/sonicwall.md:10 — Dale: wordiness	Same shared boilerplate intro paragraph; skipped for site-wide consistency.
docs/auditor/10.7/configuration/networkdevices/ciscoasa.md:23 — Dale: passive-voice	The bullet says the logging host parameter is set to the address of the audited Cisco ASA device, while step 4 says to set it to the Netwrix Auditor Server IP. Fixing the voice here would require resolving that factual contradiction first, which is out of Dale scope and needs a subject-matter decision. Only the dangling modifier was fixed.

Ask @claude on this PR if you'd like an explanation of any fix.