Logging – System parameters change

   -registry changes

Yes

  - changing or replacing important system  files

Yes

  or any system changes which maybe take to instability  operating system normal functionality..

Much harder, since this is a million different ways an o/s could become unstable, but looking at certain system registry keys and system/system32 directories will give you alot of information you are looking for.

Logging – Connection to share on   computer???

Sorry it was incorrect.

Logging – Connection  to share folder on agent's computer?

Yes, you can log read/write access to a local folder which is shared, and with source @network in your rules, the actual attempt to connect to the share is probably a bit more difficult.

you could monitor connections on port 445 from @network, that would tell you if they're connected to a windows share, but not *which* windows share.

Actually you can monitor... if an event is logged into the Windows event logger, CSA can log that event as well....

We used the event logger to pull specific event log information into out CSA logs.. like, login and logout and disk errors.

I hope that helps,

-dt