diff --git a/docs/kb/threatprevention/troubleshooting-and-diagnostics/enabling-additional-logging-for-the-threat-prevention-admin-console.md b/docs/kb/threatprevention/troubleshooting-and-diagnostics/enabling-additional-logging-for-the-threat-prevention-admin-console.md index e232d13569..646b9d2aff 100644 --- a/docs/kb/threatprevention/troubleshooting-and-diagnostics/enabling-additional-logging-for-the-threat-prevention-admin-console.md +++ b/docs/kb/threatprevention/troubleshooting-and-diagnostics/enabling-additional-logging-for-the-threat-prevention-admin-console.md @@ -13,47 +13,39 @@ keywords: - SIWinConsole - Update Log Levels products: - - threat-prevention -sidebar_label: Enabling additional logging for the Threat Prevent -tags: [] -title: "Enabling additional logging for the Threat Prevention Admin Console" + - threatprevention +sidebar_label: "Enabling Additional Logging for the Threat Prevention Admin Console" +tags: + - kb +title: "Enabling Additional Logging for the Threat Prevention Admin Console" knowledge_article_id: kA04u0000000I2PCAU --- -# Enabling additional logging for the Threat Prevention Admin Console +# Enabling Additional Logging for the Threat Prevention Admin Console -## Summary -Enabling additional logging for the Threat Prevention Admin Console - -## Issue -How to enable additional logging for the Threat Prevention Admin Console. +## Overview +This article describes how to enable additional logging for the Threat Prevention Admin Console. ## Instructions -There are two options for enabling additional logging: +There are two options: edit the log config file directly on the SI management server, or update the log level from within the Admin Console. + +> **NOTE:** Version 8.1 changed the logging engine used by the Admin Console, so the `SIWinConsole.log.config` file has a different format. In version 8.1 and later: +> +> - The root element is `` instead of ``, and the `minlevel` attribute on a `` rule sets the log level rather than a `` element. +> - Saving the file applies the change immediately. Restarting the Admin Console is not necessary. +> - Option 2 writes a log level back to the configuration file, so it survives a restart. -### Option one +### Option 1 1. Access the SI management server. 2. Open the Enterprise Manager installation folder. The default location is `...\STEALTHbits\StealthINTERCEPT\SIWinConsole`. 3. Edit the file called `SIWinConsole.log.config` in your favorite text editor. -4. Change `WARN` to `DEBUG` in the following portion of that file: - -``` - -``` +4. Change `WARN` to `DEBUG` in the file, then save the config file and restart the Threat Prevention Admin Console. -5. Save the config file and restart the Threat Prevention Admin Console. - -### Option two -1. Open the Threat Prevention Admin Console on the SI management server. +### Option 2 +1. Open the **Threat Prevention Admin Console** on the SI management server. 2. Select **Agents**. -3. Click on the Pencil icon at the top left of the window. +3. Click the **Pencil** icon at the top left of the window. 4. Change the drop-down under **Administration Console** to `DEBUG`. -5. Click the **Update Log Levels** button. +5. Click the **Update Log Levels** button to apply the change. After collecting debug logs switch Threat Prevention Admin Console logging back to `WARN`. - -## Module -SI - Admin Console - -## Salesforce Article ID -000001063 diff --git a/docs/kb/threatprevention/troubleshooting-and-diagnostics/enabling-debug-logging-on-the-steathintercept-windows-agent.md b/docs/kb/threatprevention/troubleshooting-and-diagnostics/enabling-debug-logging-on-the-steathintercept-windows-agent.md index 53b208d364..6ea3132fb3 100644 --- a/docs/kb/threatprevention/troubleshooting-and-diagnostics/enabling-debug-logging-on-the-steathintercept-windows-agent.md +++ b/docs/kb/threatprevention/troubleshooting-and-diagnostics/enabling-debug-logging-on-the-steathintercept-windows-agent.md @@ -1,8 +1,8 @@ --- description: >- - Shows how to enable debug logging for the Netwrix Threat Manager Windows agent - by editing the agent log config or updating log levels from the Threat - Prevention Administration Console. + Shows how to enable debug logging for the Netwrix Threat Prevention Windows + agent by editing the agent log config or updating log levels from the + Threat Prevention Administration Console. keywords: - debug logging - Windows agent @@ -10,26 +10,30 @@ keywords: - log config - DEBUG - WARN - - Netwrix Threat Manager + - Netwrix Threat Prevention - Threat Prevention Administration Console products: - - threat-prevention -sidebar_label: Enabling debug logging on the Netwrix Threat Manager Windows agent -tags: [] -title: "Enabling debug logging on the Netwrix Threat Manager Windows agent" + - threatprevention +sidebar_label: "Enabling Debug Logging on the Netwrix Threat Prevention Windows Agent" +tags: + - kb +title: "Enabling Debug Logging on the Netwrix Threat Prevention Windows Agent" knowledge_article_id: kA04u0000000I2dCAE --- -# Enabling debug logging on the Netwrix Threat Manager Windows agent +# Enabling Debug Logging on the Netwrix Threat Prevention Windows Agent -## Summary -Enabling debug logging on the Netwrix Threat Manager Windows agent. - -## Issue -How to enable debug logging on the Netwrix Threat Manager Windows agent. +## Overview +This article describes how to enable debug logging on the Netwrix Threat Prevention Windows agent. ## Instructions -There are two options. +There are two options: edit the agent's log config file directly on the server running the agent, or update the log level for one or more agents remotely from the Administration Console. + +> **NOTE:** Version 8.1 changed the logging engine used by the agent, so the `SIWindowsAgent.log.config` file has a different format. In version 8.1 and later: +> +> - The root element is `` instead of ``, and the `minlevel` attribute on a `` rule sets the log level rather than a `` element. +> - Saving the file applies the change immediately. Restarting the `SIWindowsAgent` service is not necessary. +> - Option 2 writes a log level back to the configuration file, so it survives a service restart. ### Option 1 1. Access the server with the SI Windows agent running. @@ -37,16 +41,16 @@ There are two options. 3. Edit the file named `SIWindowsAgent.log.config` in your favorite text editor. 4. Change `WARN` to `DEBUG` in the appropriate portion of that file: - ![LogConfig.png](../0-images/ka0Qk000000DmDJ_0EM4u000004d1hf.png) + ![Log config file with the WARN value changed to DEBUG](../0-images/ka0Qk000000DmDJ_0EM4u000004d1hf.png) 5. Save the `.log.config` file and restart the `SIWindowsAgent` service. ### Option 2 -1. Open the Netwrix Threat Prevention Administration Console on the SI management server. +1. Open the **Netwrix Threat Prevention Administration Console** on the SI management server. 2. Select **Agents**. -3. Click on the Pencil icon at the top left of the window. +3. Click the **Pencil** icon at the top left of the window. 4. Change the drop-down under **New Agent Log Level** to `DEBUG`. -5. Highlight the desired agents you wish to change the log level of from the list below. -6. Click the **Update Log Levels** button. +5. Select the agents whose log level you want to change from the list below. +6. Click the **Update Log Levels** button to apply the change. After collecting debug logs, set Netwrix Threat Prevention Windows agent logging back to `WARN`. diff --git a/docs/threatprevention/8.1/admin/_category_.json b/docs/threatprevention/8.1/admin/_category_.json new file mode 100644 index 0000000000..51435b6e32 --- /dev/null +++ b/docs/threatprevention/8.1/admin/_category_.json @@ -0,0 +1,10 @@ +{ + "label": "Administration", + "position": 40, + "collapsed": true, + "collapsible": true, + "link": { + "type": "doc", + "id": "overview" + } +} \ No newline at end of file diff --git a/docs/threatprevention/8.1/admin/agents/_category_.json b/docs/threatprevention/8.1/admin/agents/_category_.json new file mode 100644 index 0000000000..bbf550f6ac --- /dev/null +++ b/docs/threatprevention/8.1/admin/agents/_category_.json @@ -0,0 +1,10 @@ +{ + "label": "Agents Interface", + "position": 40, + "collapsed": true, + "collapsible": true, + "link": { + "type": "doc", + "id": "overview" + } +} \ No newline at end of file diff --git a/docs/threatprevention/8.1/admin/agents/agent-management/_category_.json b/docs/threatprevention/8.1/admin/agents/agent-management/_category_.json new file mode 100644 index 0000000000..d48b1d56c3 --- /dev/null +++ b/docs/threatprevention/8.1/admin/agents/agent-management/_category_.json @@ -0,0 +1,6 @@ +{ + "label": "Agent Management", + "position": 40, + "collapsed": true, + "collapsible": true +} \ No newline at end of file diff --git a/docs/threatprevention/8.1/admin/agents/agent-management/clearqueue.md b/docs/threatprevention/8.1/admin/agents/agent-management/clearqueue.md new file mode 100644 index 0000000000..920828f915 --- /dev/null +++ b/docs/threatprevention/8.1/admin/agents/agent-management/clearqueue.md @@ -0,0 +1,62 @@ +--- +title: "Clear SQLite Agent Queue" +description: "Clear SQLite Agent Queue" +sidebar_position: 80 +--- + +# Clear SQLite Agent Queue + +When the Agent is unable to communicate with the Enterprise Manager, Agent events queue up in the +Agents local SQLite database until the Enterprise Manager is available to accept events. The Clear +SQLite Agent Queue option dumps the queue and discards all pending events. + +To clear the SQLite Agent queue for an Agent: + +:::warning +Threat Prevention permanently deletes these events, and the Enterprise Manager doesn't +process them on reconnection. This option is for diagnostic and troubleshooting purposes only. +::: + + +**Step 1 –** Click Agents in the left pane to launch the Agents interface. + +**Step 2 –** Right-click a server/Agent and select **Clear SQLite Agent Queue** on the menu. + +![Enter Credentials window](/images/threatprevention/8.1/install/upgrade/entercredentials.webp) + +**Step 3 –** On the Enter Credentials window, enter a username and password with sufficient rights +to connect to the target machine and query information about shares. A local Administrator account +on the target machine should have access to the system shares. Click **OK** after entering the +credentials. + +:::note +The wizard doesn't block access to the Administration Console, and you can minimize it while +actions are in progress. If you hide the wizard by clicking outside of the dialog box, a flashing +blue link with the action name displays in the upper right corner of the interface. Click +the flashing link to return the focus to the wizard. +::: + + +**Step 4 –** On the Access Verification window, the system performs a prerequisites or verification +check that can fail or succeed. + +- Failed – Read the failure messages and close the window. Resolve any error messages before the + next attempt. +- Success – Click **Next** to begin clearing the SQLite Agent Queue + +:::note +Closing the Administration Console while this action is in process causes problems with +data collection. +::: + + +**Step 5 –** The Clear Agent Queue window displays the task in progress and then its status as +either: + +- Failed – Read the failure messages and close the window. Resolve any error messages before the + next attempt. +- Completed – Indicates that the task is completed + +**Step 6 –** When the task is successfully completed, click **Finish** to close the window. + +Threat Prevention automatically clears the SQLite Agent queue. diff --git a/docs/threatprevention/8.1/admin/agents/agent-management/harden.md b/docs/threatprevention/8.1/admin/agents/agent-management/harden.md new file mode 100644 index 0000000000..6093681be5 --- /dev/null +++ b/docs/threatprevention/8.1/admin/agents/agent-management/harden.md @@ -0,0 +1,47 @@ +--- +title: "Harden Agent" +description: "Harden Agent" +sidebar_position: 40 +--- + +# Harden Agent + +You can harden an Agent to prevent anyone from altering, stopping, or starting it from within the +local Service Control Manager. + +To harden the Agent on a server: + +**Step 1 –** Click Agents in the left pane to launch the Agents interface. + +**Step 2 –** Right-click a server/Agent and select **Harden Agent** on the menu. + +**Step 3 –** On the Access Verification window, the system performs a prerequisites or verification +check that can fail or succeed. + +- Failed – Read the failure messages and close the window. Resolve any error messages before the + next attempt. +- Success – Click **Next** to begin hardening the Agent. + +:::note +The wizard doesn't block access to the Administration Console, and you can minimize it while +actions are in progress. If you hide the wizard by clicking outside of the dialog box, a flashing +blue link with the action name displays in the upper right corner of the interface. Click +the flashing link to return the focus to the wizard. +::: + + +:::note +Closing the Administration Console while this action is in process causes problems with +data collection. +::: + + +**Step 4 –** The Harden Agent window displays the task in progress and then its status as either: + +- Failed – Read the failure messages and close the window. Resolve any error messages before the + next attempt. +- Completed – Indicates that the task is completed + +**Step 5 –** When the task is successfully completed, click **Finish** to close the window. + +The Agent's status changes to _Hardened_. diff --git a/docs/threatprevention/8.1/admin/agents/agent-management/removeserver.md b/docs/threatprevention/8.1/admin/agents/agent-management/removeserver.md new file mode 100644 index 0000000000..653d706641 --- /dev/null +++ b/docs/threatprevention/8.1/admin/agents/agent-management/removeserver.md @@ -0,0 +1,24 @@ +--- +title: "Remove Server from List" +description: "Remove Server from List" +sidebar_position: 70 +--- + +# Remove Server from List + +The Agents Interface displays a list of servers where the Agent is deployed. You can remove a server +from this list for any reason, such as when the server no longer needs the Agent. + +:::note +If the server has a deployed Agent, Threat Prevention adds the server back to the list the +next time the Agent sends information to the Enterprise Manager. +::: + + +To remove a server from the list on the Agents Interface: + +**Step 1 –** Click Agents in the left pane to launch the Agents interface. + +**Step 2 –** Right-click a server and select **Remove Server from List** on the menu. + +Threat Prevention removes the server from the list. diff --git a/docs/threatprevention/8.1/admin/agents/agent-management/soften.md b/docs/threatprevention/8.1/admin/agents/agent-management/soften.md new file mode 100644 index 0000000000..ed9827b58b --- /dev/null +++ b/docs/threatprevention/8.1/admin/agents/agent-management/soften.md @@ -0,0 +1,47 @@ +--- +title: "Soften Agent" +description: "Soften Agent" +sidebar_position: 50 +--- + +# Soften Agent + +You can soften a previously hardened Agent. Softening unlocks the Agent so it can be controlled from +within the local Service Control Manager. + +To soften the Agent on a server: + +**Step 1 –** Click Agents in the left pane to launch the Agents interface. + +**Step 2 –** Right-click a hardened Agent and select **Soften Agent** on the menu. + +**Step 3 –** On the Access Verification window, the system performs a prerequisites or verification +check that can fail or succeed. + +- Failed – Read the failure messages and close the window. Resolve any error messages before the + next attempt. +- Success – Click **Next** to begin softening the Agent. + +:::note +The wizard doesn't block access to the Administration Console, and you can minimize it while +actions are in progress. If you hide the wizard by clicking outside of the dialog box, a flashing +blue link with the action name displays in the upper right corner of the interface. Click +the flashing link to return the focus to the wizard. +::: + + +:::note +Closing the Administration Console while this action is in process causes problems with +data collection. +::: + + +**Step 4 –** The Soften Agent window displays the task in progress and then its status as either: + +- Failed – Read the failure messages and close the window. Resolve any error messages before the + next attempt. +- Completed – Indicates that the task is completed + +**Step 5 –** When the task is successfully completed, click **Finish** to close the window. + +The Agent is no longer hardened. diff --git a/docs/threatprevention/8.1/admin/agents/agent-management/start.md b/docs/threatprevention/8.1/admin/agents/agent-management/start.md new file mode 100644 index 0000000000..a0c586b684 --- /dev/null +++ b/docs/threatprevention/8.1/admin/agents/agent-management/start.md @@ -0,0 +1,42 @@ +--- +title: "Start Agent" +description: "Start Agent" +sidebar_position: 10 +--- + +# Start Agent + +If the Agent has stopped on a server, it no longer monitors and captures events. You must restart it +on the server to enable it to monitor and capture events again. + +To start a stopped Agent on a server: + +**Step 1 –** Click Agents in the left pane to launch the Agents interface. + +**Step 2 –** Right-click a server/Agent and select **Start Agent** on the menu. + +![Enter Credentials window](/images/threatprevention/8.1/install/upgrade/entercredentials.webp) + +**Step 3 –** On the Enter Credentials window, enter a username and password with sufficient rights +to connect to the target machine and query information about shares. A local Administrator account +on the target machine should have access to the system shares. Click **OK** after entering the +credentials. + +:::note +The wizard doesn't block access to the Administration Console, and you can minimize it while +actions are in progress. If you hide the wizard by clicking outside of the dialog box, a flashing +blue link with the action name displays in the upper right corner of the interface. Click +the flashing link to return the focus to the wizard. +::: + + +**Step 4 –** On the Start Agent window, Threat Prevention starts the Agent. One of two status +messages displays: + +- Failed – Read the failure messages and close the window. Resolve any error messages before the + next attempt. +- Completed – Indicates that the task is completed + +**Step 5 –** When the task is successfully completed, click **Finish** to close the window. + +The Agent now runs on the server. diff --git a/docs/threatprevention/8.1/admin/agents/agent-management/startpendingmodules.md b/docs/threatprevention/8.1/admin/agents/agent-management/startpendingmodules.md new file mode 100644 index 0000000000..a7b3e49c0e --- /dev/null +++ b/docs/threatprevention/8.1/admin/agents/agent-management/startpendingmodules.md @@ -0,0 +1,36 @@ +--- +title: "Start Pending Modules" +description: "Start Pending Modules" +sidebar_position: 30 +--- + +# Start Pending Modules + +If you deployed the Agent using the Safe Mode option, it could enter a _Start Pending Modules_ +state, in which the AD Events monitoring module doesn't load on the machine where the Agent is +deployed. This happens due to a change in the DLL versions. To exit this state, the Threat +Prevention administrator must start the Active Directory module. See the +[Agent Safe Mode](/docs/threatprevention/8.1/admin/agents/safemode.md) topic for additional information. + +:::info +If multiple DCs are in the Start Pending Modules state, one of the +monitored system DLLs changed since the Agent last ran. This could impact the operation +of the Agent. Enable the pending modules on one DC first and verify that +Threat Prevention collects events as expected from that DC and that the DC appears to +be stable before starting the pending modules on additional DCs. +::: + + +To start pending modules on a server: + +**Step 1 –** Click Agents in the left pane to launch the Agents interface. + +**Step 2 –** Right-click a server/Agent and select **Start Pending Modules** on the menu. + +:::note +The Agent's status is _Active (Modules Pending)_ when modules are pending. +::: + +The Starting window opens. + +**Step 3 –** After the pending modules start, the status changes to _Active_. diff --git a/docs/threatprevention/8.1/admin/agents/agent-management/stop.md b/docs/threatprevention/8.1/admin/agents/agent-management/stop.md new file mode 100644 index 0000000000..2869c9644e --- /dev/null +++ b/docs/threatprevention/8.1/admin/agents/agent-management/stop.md @@ -0,0 +1,41 @@ +--- +title: "Stop Agent" +description: "Stop Agent" +sidebar_position: 20 +--- + +# Stop Agent + +You can stop the Agent on a server for any reason, such as troubleshooting. + +To stop the Agent on a server: + +**Step 1 –** Click **Agents** in the left pane to launch the Agents interface. + +![Enter Credentials window](/images/threatprevention/8.1/install/upgrade/entercredentials.webp) + +**Step 2 –** Right-click a server/Agent and select **Stop Agent** on the menu. + +**Step 3 –** On the Enter Credentials window, enter a username and password with sufficient rights +to connect to the target machine and query information about shares. A local Administrator account +on the target machine should have access to the system shares. Click **OK** after entering the +credentials. + +:::note +The wizard doesn't block access to the Administration Console, and you can minimize it while +actions are in progress. If you hide the wizard by clicking outside of the dialog box, a flashing +blue link with the action name displays in the upper right corner of the interface. Click +the flashing link to return the focus to the wizard. +::: + + +**Step 4 –** On the Stop Agent window, Threat Prevention stops the Agent. One of two status +messages displays: + +- Failed – Read the failure messages and close the window. Resolve any error messages before the + next attempt. +- Completed – Indicates that the task is completed + +**Step 5 –** When the task is successfully completed, click **Finish** to close the window. + +The Agent's status changes to _Stopped_. diff --git a/docs/threatprevention/8.1/admin/agents/agent-management/upgradeadmonitor.md b/docs/threatprevention/8.1/admin/agents/agent-management/upgradeadmonitor.md new file mode 100644 index 0000000000..d83dc3d0fe --- /dev/null +++ b/docs/threatprevention/8.1/admin/agents/agent-management/upgradeadmonitor.md @@ -0,0 +1,45 @@ +--- +title: "Upgrade ADMonitor" +description: "Upgrade ADMonitor" +sidebar_position: 60 +--- + +# Upgrade ADMonitor + +You can update the instrumentation DLL, SI.ActiveDirectoryMonitor.dll (commonly known as ADMonitor +DLL), in LSASS without having to upgrade the entire Agent. To facilitate this, the +[Agents Interface](/docs/threatprevention/8.1/admin/agents/overview.md) displays the installed versions of the Agent and the +ADMonitor DLL. + +:::note +The Agent and the ADMonitor DLL should have the same major/minor version, such as 8.1.x.x, +where x.x for the DLL can be equal or higher than that of the Agent. Example: Agent 8.1.0.123 and +DLL 8.1.0.777 +::: + + +In previous Threat Prevention versions, you had to uninstall the Agent and then reinstall it just to +update the ADMonitor DLL. With Threat Prevention 7.5, use the _Upgrade ADMonitor_ feature to replace +the DLL without having to uninstall and reinstall the Agent. + +To update ADMonitor: + +**Step 1 –** Click **Agents** in the left pane to launch the Agents interface. + +**Step 2 –** Right-click a server/Agent and select **Upgrade ADMonitor** on the menu. + +**Step 3 –** On the Access Verification window, the system runs a check to verify if the Agent is +accessible. If yes, Success displays in the Status column. Click **Next** to proceed. + +**Step 4 –** The Upgrade AD Monitor window displays the ADMonitor upgrade progress. Progress +statuses are: + +- Starting – Indicates that the ADMonitor update operation is about to start +- Started – The ADMonitor update operation has successfully started and it is in progress. You may + close the window as the process will complete on its own. +- Failed – Read the failure messages and close the window. Resolve any error messages before the + next attempt. + +**Step 5 –** When the upgrade completes, click **Close**. + +ADMonitor is now updated. diff --git a/docs/threatprevention/8.1/admin/agents/agents-windows/_category_.json b/docs/threatprevention/8.1/admin/agents/agents-windows/_category_.json new file mode 100644 index 0000000000..4f59c74977 --- /dev/null +++ b/docs/threatprevention/8.1/admin/agents/agents-windows/_category_.json @@ -0,0 +1,6 @@ +{ + "label": "Agents Windows", + "position": 30, + "collapsed": true, + "collapsible": true +} \ No newline at end of file diff --git a/docs/threatprevention/8.1/admin/agents/agents-windows/agentinstallerupdate.md b/docs/threatprevention/8.1/admin/agents/agents-windows/agentinstallerupdate.md new file mode 100644 index 0000000000..0617f74c4e --- /dev/null +++ b/docs/threatprevention/8.1/admin/agents/agents-windows/agentinstallerupdate.md @@ -0,0 +1,46 @@ +--- +title: "Agent Installer Update Window" +description: "Agent Installer Update Window" +sidebar_position: 10 +--- + +# Agent Installer Update Window + +Netwrix periodically releases updated Agent installation packages. Typically these updates +accompany Microsoft KBs (hot-fixes) that alter the LSASS components and interfere with the +Agent instrumentation. See the [Agent Information](/docs/threatprevention/8.1/install/agent/overview.md) topic for +additional information. + +To download an installation package, the Threat Prevention server must be connected to the internet. +You may need to allow the following URL in the browser security settings: + +- For Threat Prevention v8.1: + [https://www.netwrix.com/go/siagent810zip](https://www.netwrix.com/go/siagent810zip) + +To download the updated Agent installer: + +**Step 1 –** Click **Agents** in the left pane to launch the Agents interface. Then click **Update +Agent Installer** to launch the Agent Installer Update window. + +![Agent Installer Update window](/images/threatprevention/8.1/admin/agents/window/checkfornewversion.webp) + +**Step 2 –** Click **Check for Newer Version of the Netwrix Threat Prevention Agent**. Threat +Prevention downloads the Agent installer from a static URL and then compares the Agent installer +in use to the installer downloaded. + +![Agent Installer Update window showing that Agent Installer is up-to-date](/images/threatprevention/8.1/admin/agents/window/uptodate.webp) + +- If the versions are the same, the message specifies **Agent Installer is up-to-date…** and + displays the Agent version number. Click **Close** to close the window. + +![Agent Installer Update window showing that Agent version is outdated](/images/threatprevention/8.1/admin/agents/window/agentversionmismatch.webp) + +- If the downloaded version is newer, the message displays both version numbers and provides an + option to apply the update. Click **Apply Update**. + +:::note +When you replace the Agent installer with a newer version, the Agents interface highlights +every Agent version to indicate that it isn't the current version. Update those Agents to the new +version using the Upgrade Agent option on the right-click menu. + +::: diff --git a/docs/threatprevention/8.1/admin/agents/agents-windows/configureautodeploy.md b/docs/threatprevention/8.1/admin/agents/agents-windows/configureautodeploy.md new file mode 100644 index 0000000000..e1c335ad0d --- /dev/null +++ b/docs/threatprevention/8.1/admin/agents/agents-windows/configureautodeploy.md @@ -0,0 +1,40 @@ +--- +title: "Configure Auto Deploy Window" +description: "Configure Auto Deploy Window" +sidebar_position: 20 +--- + +# Configure Auto Deploy Window + +You can automatically deploy Agents to discovered domain controllers in a domain, provided that the +Agent is already deployed on at least one domain controller in the domain. + +To auto deploy the Agent: + +**Step 1 –** Click **Agents** in the left pane to launch the Agents interface. Then click +**Configure Auto Deploy** to launch the Configure Auto Deploy window. + +![Configure Auto Deploy window](/images/threatprevention/8.1/admin/agents/window/autodeploy.webp) + +**Step 2 –** Select the **Enable Auto Deploy** checkbox to enable the following configuration +options: + +- Credentials – Provide the credentials to use for deploying the Agent on all discovered domain + controllers + - Login – Must be in Domain\User format + - Password +- Agent Deploy Destination Options – Configure the following settings: + - Installation Location – Select the radio button to indicate the installation directory on the + target domain controllers + - Default – Uses the default installation directory + - Textbox – Enter the installation location you want, e.g. d:\myagent + - Safe Mode – If selected, the Agent checks LSASS versions on start up. Any changes in LSASS + since the previous start prevents the Windows AD Events monitoring module from loading. See + the [Agent Safe Mode](/docs/threatprevention/8.1/admin/agents/safemode.md) topic for additional information. + - EM IP Address/Name – Displays the IP address of the machine where Enterprise Manager is + installed + - Port – Displays the port the Enterprise Manager uses to communicate with the Agent + +**Step 3 –** Click **Apply** to enable the auto deploy feature. When Threat Prevention discovers +domain controllers where the Agent isn't already installed, it automatically deploys the +Agent with all applicable modules to those domain controllers. diff --git a/docs/threatprevention/8.1/admin/agents/agents-windows/enrollmentsecretconfiguration.md b/docs/threatprevention/8.1/admin/agents/agents-windows/enrollmentsecretconfiguration.md new file mode 100644 index 0000000000..d2606e9999 --- /dev/null +++ b/docs/threatprevention/8.1/admin/agents/agents-windows/enrollmentsecretconfiguration.md @@ -0,0 +1,51 @@ +--- +title: "Enrollment Secret Configuration Window" +description: "Enrollment Secret Configuration Window" +sidebar_position: 30 +--- + +# Enrollment Secret Configuration Window + +The Enrollment Secret is a limited-life (1 hour) password generated by the Enterprise Manager. The +Agent Installer uses it to ensure that the Agent connects to a legitimate Enterprise Manager. It +enables the automatic exchange of certificates between the Enterprise Manager and the Agent. How you +apply the enrollment secret depends on the method you use to install the Agent. + +- If you use the Administration Console to deploy the Agent, the console automatically generates + and uses a new enrollment secret as part of automated Agent installation. +- If you install the Agent manually, enter the enrollment secret in the Certificates window + of the Agent Setup wizard during installation. See the + [Manual Agent Deployment](/docs/threatprevention/8.1/install/agent/manual.md) topic for additional information. + +To generate the enrollment secret, complete the following steps: + +**Step 1 –** Click **Agents** in the left pane to launch the Agents interface. Then click **Agent +Enrollment Secret** to launch the Enrollment Secret Configuration window. + +![Enrollment Secret Configuration window](/images/threatprevention/8.1/admin/agents/window/enrollmentsecret.webp) + +Use the Enrollment Secret Configuration window to generate the enrollment secret required to +manually deploy the Agent. It has the following fields: + +- Enrollment Secret – A limited-life (1 hour) password generated by the Enterprise Manager. The + Agent Installer uses it to ensure that the Agent connects to a legitimate Enterprise Manager. +- Expires in – The expiration date timestamp for the enrollment secret +- EM cert – The Enterprise Manager certificate generated by the certificate authority for use by the + Enterprise Manager to establish trust between the Enterprise Manager and other modules including + the Agent + + - Note the value of the Enterprise Manager certificate (EM cert) and verify that it is the same + value displayed in the Agent installer to ensure that the Agent is connecting to a legitimate + Enterprise Manager. + +**Step 2 –** Click **Generate** to generate an enrollment secret, which is valid for 1 hour. + +- When you deploy the Agent from the Administration Console, Threat Prevention automatically creates + a new enrollment secret, which invalidates any previous secret that hasn't expired. +- Click **Copy** to copy the enrollment secret and enter it in the Certificates window of the Agent + Setup wizard during manual Agent installation. + +:::note +Restarting the Enterprise Manager cancels the current enrollment secret. + +::: diff --git a/docs/threatprevention/8.1/admin/agents/agents-windows/loglevelconfiguration.md b/docs/threatprevention/8.1/admin/agents/agents-windows/loglevelconfiguration.md new file mode 100644 index 0000000000..84dd6fc6d6 --- /dev/null +++ b/docs/threatprevention/8.1/admin/agents/agents-windows/loglevelconfiguration.md @@ -0,0 +1,146 @@ +--- +title: "Log Level Configuration Window" +description: "Log Level Configuration Window" +sidebar_position: 40 +--- + +# Log Level Configuration Window + +The Log Level Configuration window displays the current log levels for the Agents, Enterprise +Manager, and Administration Console. You can also use it to set new log levels. + +:::note +Since Threat Prevention supports multiple instances of the Administration Console, each +instance has its own settings for log levels. Changing the settings affects only the respective +console instance. The Enterprise Manager and Agent log settings are global - the most recent changes +made from any console instance apply. +::: + + +To set log levels: + +**Step 1 –** Click **Agents** in the left pane to launch the Agents interface. Then click **Update +Logging Levels** on the top bar to launch the Log Level Configuration window. + +![Log Level Configuration Window](/images/threatprevention/8.1/admin/agents/window/loglevelconfiguration.webp) + +**Step 2 –** To update the logging level for an Agent: + +- The Active Agent List data grid lists the active Agents with the following information: + + - Platform – Operating system platform for the machine where the Agent is deployed, for example, + Windows + - Domain – Targeted Active Directory domain + - Machine Name – Server where the Agent is deployed + - Agent Address – IP address of the server where the Agent is deployed + - Version – Agent build version + - Log Level – The current log level set for the Agent + +- Select an Agent in the data grid and choose a new log level from the New Agent Log Level dropdown + menu. Then click Update Log Levels to assign the log level to the Agent. Available file log levels + are: + + - Debug – Records everything that happens, most verbose level of logging + - Info – Records information about individual APIs called, in addition to warnings and errors + - Warn – Records all warnings that occur, in addition to errors + - Error – Records all errors that occur + - Fatal – Records only when catastrophic system failures/crashes occur + + No matter which log level you select, Threat Prevention archives a log file when it reaches its + size limit and keeps up to ten archived files per log. When it creates the eleventh archive, it + deletes the oldest one. See the + [Log Files and Logging Configuration](/docs/threatprevention/8.1/troubleshooting/logging.md) topic + for additional information on where the logs are written and how archived files are named. + + :::note + Threat Prevention writes a log level set from the Administration Console or through PowerShell + back to the configuration file of the component it applies to, so the setting survives a service + restart. + ::: + +**Step 3 –** To update the logging level for Enterprise Manager and the Administration Console: + +- Current Level – The current log level set for the Enterprise Manager / Administration Console +- New Level – Use the dropdown menu to select a new log level.Then click Update Log Levels to assign + the new log level to the Enterprise Manager / Administration Console. +- Build – The build of the Enterprise Manager / Administration Console. The builds may differ in + rare scenarios. +- Time Stamp – The date and time when the Enterprise Manager / Administration Console build was last + updated + +**Step 4 –** Click **Close** to close the window. + +## Access Agent Log Files + +**Get Agent Log** collects the Agent log files into a single ZIP archive and downloads it. The +archive holds the complete contents of two folders on the Agent server: + +- `logs`, which holds the Agent host logs +- `ADMonitor_logs`, which holds the AD Monitor logs. This folder exists only where AD Monitor runs, + which is on a domain controller. + +The archive includes every file in both folders — active and archived alike — so a single download +gives Netwrix Support the full history rather than the most recent entries alone. See the +[Log Files and Logging Configuration](/docs/threatprevention/8.1/troubleshooting/logging.md) and +[AD Monitor Logging Configuration](/docs/threatprevention/8.1/troubleshooting/admonitorlogging.md) +topics for a description of the individual log files. + +:::note +In versions before 8.1, **Get Agent Log** downloaded the active Agent log file on its own. +You had to collect AD Monitor logs from the domain controller by hand. +::: + +To collect the Agent log files: + +![Get Agent Log icon](/images/threatprevention/8.1/admin/agents/window/getagentlog.webp) + +**Step 1 –** Click **Agents** in the left pane to launch the Agents interface. Select a server/Agent +and click **Get Agent Log** . + +![Save As window for Agent logs](/images/threatprevention/8.1/admin/agents/window/saveaswindow.webp) + +**Step 2 –** The Save As window opens. Select the location for the archive and click **Save**. + +You can now review the Agent log files, or attach the archive to a support case, without connecting +to the machine where the Agent is deployed. + +:::tip +Collect the archive after you reproduce a problem, not before. The archive is a snapshot of +the log folders at the moment you download it. +::: + +## Access the Enterprise Manager & Administration Console Log Files + +Threat Prevention stores the Enterprise Manager log files on the Threat Prevention server, and +stores the Administration Console log files on the machine where the respective console is +installed. + +The default log file locations are: + +**Enterprise Manager Log Files** + +![Enterprise Manager Log File Location](/images/threatprevention/8.1/admin/agents/window/emlogs.webp) + +The default location is: + +**…\Netwrix\Netwrix Threat Prevention\SIEnterpriseManager\logs\** + +Administration Console Log Files + +![Administration Console Log File Location](/images/threatprevention/8.1/admin/agents/window/consolelogs.webp) + +The default location is: + +**…\Netwrix\Netwrix Threat Prevention\SIWinConsole\logs\** + +:::note +Log files for a remote instance of the Administration Console are available at the same +location on the respective machine. + +::: + +The log levels in this window don't apply to AD Monitor, the component that runs inside the LSASS +process on a domain controller. AD Monitor keeps its own configuration file and its own log files. +See the +[AD Monitor Logging Configuration](/docs/threatprevention/8.1/troubleshooting/admonitorlogging.md) +topic for additional information. diff --git a/docs/threatprevention/8.1/admin/agents/deploy/_category_.json b/docs/threatprevention/8.1/admin/agents/deploy/_category_.json new file mode 100644 index 0000000000..3b79969e0b --- /dev/null +++ b/docs/threatprevention/8.1/admin/agents/deploy/_category_.json @@ -0,0 +1,10 @@ +{ + "label": "Deploy Agents", + "position": 20, + "collapsed": true, + "collapsible": true, + "link": { + "type": "doc", + "id": "overview" + } +} \ No newline at end of file diff --git a/docs/threatprevention/8.1/admin/agents/deploy/installing.md b/docs/threatprevention/8.1/admin/agents/deploy/installing.md new file mode 100644 index 0000000000..ea87c6cd71 --- /dev/null +++ b/docs/threatprevention/8.1/admin/agents/deploy/installing.md @@ -0,0 +1,20 @@ +--- +title: "Installing Window" +description: "Installing Window" +sidebar_position: 40 +--- + +# Installing Window + +The Deploy Agents wizard's Installing window is the last in a sequence of four windows to deploy the +Agent on a computer. This window performs the selected action, tracks the deployment process, and +displays a successful or failed status. + +![Deploy Agents wizard – Installing page](/images/threatprevention/8.1/admin/agents/deploy/installing.webp) + +It displays the working and completed status of the action. If the Agent deploys correctly, the +Message column displays a success message. Otherwise, it displays a failure message with additional +text. + +To stop the deployment process on any machines that have not yet started deployment, click Cancel. +The Close button changes to a Finish button once all Agents are deployed. diff --git a/docs/threatprevention/8.1/admin/agents/deploy/overview.md b/docs/threatprevention/8.1/admin/agents/deploy/overview.md new file mode 100644 index 0000000000..dd6e73d28f --- /dev/null +++ b/docs/threatprevention/8.1/admin/agents/deploy/overview.md @@ -0,0 +1,134 @@ +--- +title: "Deploy Agents" +description: "Deploy Agents" +sidebar_position: 20 +--- + +# Deploy Agents + +You can deploy the Threat Prevention Agent through any of the following methods: + +- Deploy the Agent to servers through the Administration Console – You can deploy the Agent to one + or multiple servers through the Administration Console + + :::info + This is the recommended method for deploying the Agent. + ::: + + +- Manually through the Windows Agent Setup Wizard – Run the Agent executable to launch this wizard + +See the [Manual Agent Deployment](/docs/threatprevention/8.1/install/agent/manual.md) topic for additional +information. + +## Deploy Agents Wizard + +Use the Deploy Agents wizard to deploy Agents from the Administration Console. Computers +targeted for Agent deployment must meet the minimum .NET Framework version required by the Agent or +the deployment fails. Remember to check server requirements before deploying the Agent, including +compatibility with other security products. See the +[Agent Server Requirements](/docs/threatprevention/8.1/requirements/agent/agent.md) topic for additional information. + +:::note +The wizard doesn't block access to the Administration Console, and you can minimize it while +actions are in progress. If you hide the wizard by clicking outside of the dialog box, a flashing +blue link with the action name displays in the upper right corner of the interface. Click +the flashing blue link to return the focus to the wizard. +::: + + +The Deploy Agents wizard consists of four windows: Select Computers, Set Options, Prerequisites +Check, and Installing. + +To deploy the Agent from the Administration Console to a new or existing machine +using the Deploy Agents wizard, complete the following steps: + +:::warning +Closing the Administration Console while this action is in process causes problems with +data collection. +::: + + +**Step 1 –** Click Agents in the left pane to launch the Agents interface. + +**Step 2 –** On the Agents interface, click the **Deploy Agent** (**+**) button on the top right +corner. To re-install a previously uninstalled Agent, select the **Install Agent** right-click menu +option for that machine in the grid. The Select Computers window opens. + +![Deploy Agents wizard – Select Computers page](/images/threatprevention/8.1/admin/agents/deploy/selectcomputers.webp) + +**Step 3 –** On the Select Computers window, add the host or IP addresses of the target machines to +the Deploy Agents to These Computers box. Use any of the three methods, as represented by the three +tabs on the window. See the [Select Computers Window](/docs/threatprevention/8.1/admin/agents/deploy/selectcomputers.md) topic for additional +information. Click **Next**. + +If you open this window through the [Right-Click Menu](/docs/threatprevention/8.1/admin/agents/overview.md#right-click-menu) action, Threat +Prevention populates the list with the computers you selected on the Agents interface. + +![Deploy Agents wizard – Set Options page](/images/threatprevention/8.1/admin/agents/deploy/setoptions.webp) + +**Step 4 –** On the Set Options window, enter the credentials required to deploy the Agent on the +selected machines. Review the Enterprise Manager IP address/name and port for accuracy and select +the modules you want to install for this Agent. You can also set other properties for the Agent. See +the [Set Options Window ](/docs/threatprevention/8.1/admin/agents/deploy/setoptions.md)topic for additional information. + +**Step 5 –** After you set the configurations, click **Next**. + +![Deploy Agents wizard – Prerequisites Check page](/images/threatprevention/8.1/admin/agents/deploy/prerequisitescheck.webp) + +**Step 6 –** On the Prerequisites Check window, the credentials provided on the Set Options window +either succeed or fail during a prerequisites or verification check. It also initiates a +prerequisite check for the Agent. See the [Prerequisites Check Window](/docs/threatprevention/8.1/admin/agents/deploy/prerequisitescheck.md) topic +for additional information. + +![Deploy Agents wizard – Installing page](/images/threatprevention/8.1/admin/agents/deploy/installing.webp) + +**Step 7 –** The Installing window performs the installation and displays whether the action +was successful. See the [Installing Window ](/docs/threatprevention/8.1/admin/agents/deploy/installing.md) topic for additional information. + +**Step 8 –** When the task is successfully completed, click **Finish** to close the window. + +The Agent appears in the table on the Agents interface. + +:::note +If the server where the Agent is deployed has multiple network adapters (multi-homed), +then you must bind the Agent to an adapter that can communicate with the Enterprise +Manager. See the [Bind To](/docs/threatprevention/8.1/troubleshooting/agentcommunication.md#bind-to) topic for +additional information. +::: + + +## Update Agent Settings + +To update the settings for a deployed Agent through the Agents interface, complete the following steps: + +**Step 1 –** Click Agents in the left pane to launch the Agents interface. + +**Step 2 –** On the Agents interface, right-click the Agent and select Update Agent Settings on the +[Right-Click Menu](/docs/threatprevention/8.1/admin/agents/overview.md#right-click-menu). The Select Computers window opens. + +**Step 3 –** On the Select Computers window, Threat Prevention automatically adds the computer +where the Agent is deployed to the Update Agent settings on These Computers box. See the +[Select Computers Window](/docs/threatprevention/8.1/admin/agents/deploy/selectcomputers.md) topic for additional information. Click **Next**. + +**Step 4 –** On the Set Options window, ensure the proper credentials, modules, and Enterprise +Manager location are accurate alongside additional options. To make changes to the settings, uncheck +the **Keep Existing Settings** box. Make the necessary updates. See the +[Set Options Window ](/docs/threatprevention/8.1/admin/agents/deploy/setoptions.md) topic for additional information. + +**Step 5 –** On the Prerequisites Check window, the credentials provided on the Set Options window +either succeed or fail during a prerequisites or verification check. See the +[Prerequisites Check Window](/docs/threatprevention/8.1/admin/agents/deploy/prerequisitescheck.md) topic for additional information. Click +**Next**. + +**Step 6 –** On the Updating Settings window, Threat Prevention stops and restarts the Agent. One +of two status messages displays: + +- Failed – Read the failure message and either click **Back** to provide new credentials or click + **Finish** to close the window and resolve any error messages before the next + attempt +- Completed – Indicates that the Agent updated successfully + +**Step 7 –** Click **Finish** to close the window. + +The status of the Agent update will display in the grid on the Agents interface. diff --git a/docs/threatprevention/8.1/admin/agents/deploy/prerequisitescheck.md b/docs/threatprevention/8.1/admin/agents/deploy/prerequisitescheck.md new file mode 100644 index 0000000000..7a845a405f --- /dev/null +++ b/docs/threatprevention/8.1/admin/agents/deploy/prerequisitescheck.md @@ -0,0 +1,28 @@ +--- +title: "Prerequisites Check Window" +description: "Prerequisites Check Window" +sidebar_position: 30 +--- + +# Prerequisites Check Window + +The Deploy Agents wizard's Prerequisites Check window is the third in a sequence of four windows to +deploy the Agent on a computer. On this window, Threat Prevention checks if the provided credentials +successfully allow Agent deployment. + +![Deploy Agents wizard – Prerequisites Check page](/images/threatprevention/8.1/admin/agents/deploy/prerequisitescheck.webp) + +After the check runs, the status registers as either Success or Failed. Select a host to view the +full message in the box at the bottom of the window. + +- Failed – Read the failure message and either click **Back** to provide new credentials or click + **Finish** to close the window and resolve any error messages before the next + attempt +- Success – Click **Next** to install the Agent +- If some but not all items fail, you can click **Next** to deploy the Agent on those where access + verification succeeded + +In addition to confirming access, Threat Prevention also verifies that the target machine already +has the minimum .NET Framework version the Agent needs; otherwise the deployment fails. + +See the [Installing Window ](/docs/threatprevention/8.1/admin/agents/deploy/installing.md)topic for the next step. diff --git a/docs/threatprevention/8.1/admin/agents/deploy/selectcomputers.md b/docs/threatprevention/8.1/admin/agents/deploy/selectcomputers.md new file mode 100644 index 0000000000..e15a960e3d --- /dev/null +++ b/docs/threatprevention/8.1/admin/agents/deploy/selectcomputers.md @@ -0,0 +1,62 @@ +--- +title: "Select Computers Window" +description: "Select Computers Window" +sidebar_position: 10 +--- + +# Select Computers Window + +The Deploy Agents wizard's Select Computer window is the first in a sequence of four windows to +deploy the Agent on a computer. It provides three methods for selecting computers where you can +deploy Agents: + +- Add Single Host +- Add from AD +- Add from File + +You can use any combination of these three methods to select computers. + +## Add Single Host Tab + +The Add Single Host tab displays by default when the Select Computer window opens. + +![Deploy Agents wizard – Select Computers page](/images/threatprevention/8.1/admin/agents/deploy/selectcomputers.webp) + +Manually enter and select the host name or IP address of a computer. Use the double-arrow button to +add it to the Deploy Agents to These Computers box. + +## Add From AD Tab + +Click the Add From AD tab. + +![Deploy Agents wizard – Select Computers page: Add from AD tab](/images/threatprevention/8.1/admin/agents/deploy/addfromad.webp) + +Browse the domain's computer objects (Domain Controllers and Computers) to select those where you +want to deploy the Agent. + +- Domain to Browse – Displays the domain where the Enterprise Manager resides. If unpopulated, enter + the domain name in the textbox. Click Connect to connect to the domain. +- List of Domain Controllers/Computers – Populates with computers found in Active Directory +- Add (>) button – Adds the selected computers to the Deploy Agents to These Computers box + +:::note +You can select multiple computers and move them to the Deploy Agents to These Computers +box. Checking a top-level node automatically selects all child objects. +::: + +## Add From File Tab + +Click the Add From File tab. + +![Deploy Agents wizard – Select Computers page: Add from File tab](/images/threatprevention/8.1/admin/agents/deploy/addfromfile.webp) + +You can import a text file with a list of computer names or IP addresses with carriage returns, or a +CSV file with comma-separated values. + +- Text File to Read – Click Open to browse and select the required file. The box displays the path + to the file. +- List of Hosts/IP Addresses – Populates with computers from the text/CSV file +- Add (>) button – Adds the selected computers to the Deploy Agents to These Computers box + +After the list in the Deploy Agents to These Computers box is complete, you can continue through the +wizard to deploy the Agent. See the [Set Options Window ](/docs/threatprevention/8.1/admin/agents/deploy/setoptions.md)topic for the next step. diff --git a/docs/threatprevention/8.1/admin/agents/deploy/setoptions.md b/docs/threatprevention/8.1/admin/agents/deploy/setoptions.md new file mode 100644 index 0000000000..cf64980596 --- /dev/null +++ b/docs/threatprevention/8.1/admin/agents/deploy/setoptions.md @@ -0,0 +1,117 @@ +--- +title: "Set Options Window" +description: "Set Options Window" +sidebar_position: 20 +--- + +# Set Options Window + +The Deploy Agents wizard's Set Options window is the second in a sequence of four windows to deploy +the Agent on a computer. + +On the Set Options window, you can manage Agent settings, such as credentials, Enterprise Manager +information, modules, DNS host name resolution, and safe mode. + +![Deploy Agents wizard - Set Options page](/images/threatprevention/8.1/admin/agents/deploy/setoptions.webp) + +The Set Options window provides the following options: + +- Use These Credentials – Credentials for deploying the Agent on the selected computers + - Username – Must be in the DOMAIN\Username format + - Password – Username password +- Enterprise Manager – IP address/name and port of the Enterprise Manager +- Modules to Install – Select the check boxes for the modules to install on the selected + computers: + - Windows AD Events – Installs the Threat Prevention for Active Directory Solution and Threat + Prevention for LDAP Solution + - Windows File System – Installs the Threat Prevention for File System Solution + - Exchange Server Monitoring – Installs the Threat Prevention for Exchange Solution + - Windows Event Logs – Deprecated functionality for v7.0+ Agents +- Agent Service + + - Safe Mode – The Agent checks LSASS versions on start up. Any changes in LSASS since the + previous start prevents the AD Events monitoring module from loading. See the + [Agent Safe Mode](/docs/threatprevention/8.1/admin/agents/safemode.md) topic for additional information. + - Use local Pwned hash DB – After installation, the Enterprise Manager sends a local copy of the + Pwned hash database to the Agent. The Enterprise Manager also sends any database updates to the + Agents as long as the Agent service is enabled. + - Start Agent Service – Starts the Threat Prevention Agent service on host after installation + + :::note + If you don't start the Agent Service at the time of deployment, you must start the + Agent manually, or it starts automatically after a server reboot. Until the Agent + starts, it doesn't monitor or block any activity. + ::: + + +- Create Windows Firewall Rules – Creates firewall rules on the selected computers for Agent + communication +- Install to default location – Installs the Agent on the machine to the default location or a + specified location. + +![Deploy Agents wizard – Set Options page: Agent Install Path box](/images/threatprevention/8.1/admin/agents/deploy/installpath.webp) + +If you check this option, Threat Prevention installs the Agent to the default location: +...\Netwrix\Netwrix Threat Prevention\SIWindowsAgent + +If you clear this option, specify the installation location you want, for example, d:\myagent. + +The installation location applies to all computers where you deploy the Agent in this session +(as specified on the [Select Computers Window](/docs/threatprevention/8.1/admin/agents/deploy/selectcomputers.md) of the Deploy Agents wizard). +After you configure these settings, the Agent is ready for deployment on the selected +machines. See the [Prerequisites Check Window](/docs/threatprevention/8.1/admin/agents/deploy/prerequisitescheck.md) topic for the next step. + +##### DNS Host Name Resolution + +By default, deployment enables “Enable DNS Host Name Resolution” for the Agent. Depending +on the event type, the Agent may see some but not all of the following information: + +- NetBIOS name +- Fully Qualified Domain Name +- IP Address + +The Agent stores this information as XML tags and values in the SIWindowsAgent.exe.confg file, in +the folder where the Agent is installed. When the Agent Service starts, it reads this file. + +When the Enable DNS Host Name Resolution option is enabled, the Agent looks up the missing data. Raw +events may have one or more of following: SID, domain name, NetBiosName, machine name, and IP +address. When any one of these data points is available, Threat Prevention uses Windows DNS, if +enabled, to collect the missing data points for the raw event from LSASS. This provides more uniform +data, but may have a performance impact on the machine where the Agent is deployed, especially if +that machine doesn't handle name resolution locally. + +## Set Options Window for Update Agent Settings + +On the Agents interface, when you open the Set Options window through the Update Agent Settings +option on the [Right-Click Menu](/docs/threatprevention/8.1/admin/agents/overview.md#right-click-menu), the window appears as follows: + +![Update Agent Settings > Set Options page](/images/threatprevention/8.1/admin/agents/deploy/updatesetoptions.webp) + +This window displays the default selections in the Modules to Set and Additional Options areas; they +don't represent the actual current state of the Agent. + +:::note +To view the current state and configured options for an Agent, hover over the Version +String column on the [Agents Interface](/docs/threatprevention/8.1/admin/agents/overview.md) data grid for the tool tip. The AD Agent +column indicates the Agent’s mode. +::: + + +This Set Options window is the same as the standard Set Options window, with the following +exceptions: + +- Enable DNS Host Name Resolution – See the DNS Host Name Resolution topic for information. Even + when this option is enabled for the Agent, the window displays it as unchecked. You must either + check this setting or check the Keep Existing Settings checkbox to keep it enabled for the Agent. +- Keep Existing Settings – When you check this option, the Modules to Set and Additional Options + areas are grayed out and you can't change them, indicating that the Agent retains its current + settings. + + This setting has no impact on the Use These Credentials and Enterprise Manager areas. + +:::warning +Ensure you select the settings you want for the Agent on this window, such as the +Enable DNS Host Name Resolution and Safe Mode options, even when they are enabled for the +Agent. Leaving them unchecked will disable those settings when the wizard completes. + +::: diff --git a/docs/threatprevention/8.1/admin/agents/overview.md b/docs/threatprevention/8.1/admin/agents/overview.md new file mode 100644 index 0000000000..af63f22f7d --- /dev/null +++ b/docs/threatprevention/8.1/admin/agents/overview.md @@ -0,0 +1,228 @@ +--- +title: "Agents Interface" +description: "Agents Interface" +sidebar_position: 40 +--- + +# Agents Interface + +Use the Agents interface to view, deploy, and manage Agents from a centralized +location to the targeted domain controllers in a domain. You must deploy the Agent on all domain +controllers that you want to receive event data for. After you deploy one or more Agents to a +domain, it becomes known as a targeted domain. + +You can deploy the Threat Prevention Agent through any of the following methods: + +- Deploy the Agent to servers through the Administration Console – You can deploy the Agent to one + or multiple servers through the Administration Console + + :::info + This is the recommended method for deploying the Agent. + ::: + + +- Manually through the Windows Agent Setup Wizard – Run the Agent executable to launch this wizard + +See the [Deploy Agents](/docs/threatprevention/8.1/admin/agents/deploy/overview.md) and +[Manual Agent Deployment](/docs/threatprevention/8.1/install/agent/manual.md) topics for additional information. + +Click **Agents** in the left pane to open the Agents interface. + +![Agents Interface](/images/threatprevention/8.1/admin/agents/agentsinterface.webp) + +## Agents Data Grid + +The Agents data grid displays information on each domain where an Agent is deployed. + +The upper-right corner of the data grid displays the Agent tally, indicating the number of active +Agents as well as the total number of deployed Agents. The data grid displays the following +information for an Agent: + +- Domain – Targeted Active Directory domain +- Machine – Server where the Agent is deployed. Hover over data in this column to view the following + date/time stamps: + + - Last Agent to Manager Communication – Last change event sent from the Agent to the Enterprise + Manager + - Last Agent Heartbeat – Last time the Enterprise Manager received a heartbeat from the Agent + + ![Warning Symbol for an Agent](/images/threatprevention/8.1/admin/agents/warningsymbol.webp) + + - AD Event Latency – Time difference between when the Agent detected the event and when + the Enterprise Manager received it + + :::note + When the **Send Latency Alerts** option is enabled in the + [Event Filtering Configuration Window](/docs/threatprevention/8.1/admin/configuration/eventfilteringconfiguration.md), a + warning symbol appears to indicate excessive latency. This warning symbol also appears when + the Agent fails to load the instrumentation DLL, SI.ActiveDirectoryMonitor.dll (commonly + known as ADMonitor DLL), into the LSASS process or when it fails to load the instrumentation + DLL to MS Exchange. + ::: + + +- FSMO Roles – The FSMO (Flexible Single Master Operation) roles assigned to the domain + controller where the Agent is deployed. The column displays role names as abbreviations. For + example, it displays 'SM' for the Schema Master role. Hover over data in this column to view the + full names. + + :::note + You can use the FSMO roles information in combination with a policy created for the + [FSMO Role Monitoring Event Type](/docs/threatprevention/8.1/admin/policies/configuration/eventtype/fsmorolemonitoring.md) to view events + about which machine acquired a FSMO role and which machine relinquished it. + ::: + + +- Operating System – Operating system for the machine where the Agent is deployed with version + information, including service pack details. For example, Windows Server 2022 Standard.. For + example, Windows Server 2019 Standard + + ![Agents Interface - Agent Statuses](/images/threatprevention/8.1/admin/agents/agentstatuses.webp) + +- Status – the Agent’s current status: + + - Active (green) – The Agent is actively monitoring/blocking events and communicating with the + Enterprise Manager + - Active (Modules Pending) – The Agent is active, but the Windows AD Events module hasn't + loaded due to Safe Mode. See the [Agent Safe Mode](/docs/threatprevention/8.1/admin/agents/safemode.md) topic for additional + information. + - Stopped (orange) – The Agent is stopped and isn't monitoring/blocking events + - Lost Connection (red) – The Agent isn't actively communicating with the Enterprise Manager + - No Agent (gray) – Threat Prevention found a domain controller within the targeted domain + where the Agent isn't yet deployed + +- Address – IP address of the server where the Agent is deployed. Hover over data in this column to + view the IP address with port +- Agent Version – Installed Agent build version + + - If the Agent’s version is older than the current version available in Threat Prevention, the + grid highlights it to indicate that Netwrix recommends an upgrade. + - Hover over data in this column to view a listing of the Agent’s configured settings. This + displays information on modules that are running and those that are pending (for Safe Mode). + +- Available Version – Latest Agent version available in Threat Prevention +- ADMonitor Version – The installed SI.ActiveDirectoryMonitor.dll version + + (commonly known as ADMonitor DLL). The Agent and the ADMonitor DLL should have the same + major/minor version, such as 8.1.x.x, where x.x for the DLL can be equal or higher than that of + the Agent. Example: Agent 8.1.0.123 and DLL 8.1.0.777 + +- UTC Offset – Local server time zone relationship to the Universal Time (UTC) +- Last Events – Number of events reported by the Agent in the last notification to the Enterprise + Manager +- Events In Queue – Count of events the Agent is waiting to send to the Enterprise Manager +- AD Agent – Indicates if the Agent is running in Normal Mode or Safe Mode +- Is Signed – Indicates if the Agent is signed or unsigned +- Free Space – Amount of free space on the drive the Agent is installed on +- Agent Last Stopped – Date timestamp for when the Agent was last stopped +- Build Time Stamp – Date timestamp for when the Agent version was created +- Certificate Thumbprint – The certificate used by the Agent to communicate with Enterprise Manager +- Features – Features available for the Agent and its configured modules +- FQDN – Fully-qualified domain name of the machine where the Agent is deployed +- Last Registration – The date and time when the Agent successfully connected to the Enterprise + Manager (became Active) +- Modules – Event sources loaded and running on the Agent +- Platform – Operating system platform for the machine where the Agent is deployed, for example, + Windows + +This data grid employs features for sorting, filtering, searching, and more. See the +[ Data Grid Functionality](/docs/threatprevention/8.1/admin/navigation/datagrid.md) topic for additional information. + +## Agents Action Buttons + +Use the following icons above the data grid to perform various actions on the Agents +interface + +| Icon | Label | Action | +| ---------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| ![Agents Interface - Export Agent List icon](/images/threatprevention/8.1/admin/agents/exporticon.webp) | Export Agent List… | Save the information to an XML file for export | +| ![Agents Interface - Refresh Agent List icon](/images/threatprevention/8.1/admin/agents/refreshicon.webp) | Refresh Agent List… | Refresh the Agent information | +| ![Agents Interface - Update Logging Levels icon](/images/threatprevention/8.1/admin/agents/updateloggingicon.webp) | Update Logging Levels… | Configure the log levels for the Agents. It opens the [Log Level Configuration Window](/docs/threatprevention/8.1/admin/agents/agents-windows/loglevelconfiguration.md). | +| ![Agents Interface - Get Agent Log icon](/images/threatprevention/8.1/admin/agents/getagentlogicon.webp) | Get Agent Log… | Download a ZIP archive of the Agent log folders, `logs` and `ADMonitor_logs`, from the selected server. See the [Access Agent Log Files](/docs/threatprevention/8.1/admin/agents/agents-windows/loglevelconfiguration.md#access-agent-log-files) topic for additional information. | +| ![Agents Interface - Update Agent Installer icon](/images/threatprevention/8.1/admin/agents/updateinstallericon.webp) | Update Agent Installer | Check with Netwrix for a newer version of the Agent Installer according to the version in use. It opens the [Agent Installer Update Window](/docs/threatprevention/8.1/admin/agents/agents-windows/agentinstallerupdate.md). | +| ![Agents Interface - Configure Auto Deploy icon](/images/threatprevention/8.1/admin/agents/autodeployicon.webp) | Configure Auto Deploy | If enabled, the Agent is automatically deployed to all domain controllers without an Agent. This feature requires at least one Agent to be present in the domain to detect additional domain controllers. It opens the [Configure Auto Deploy Window](/docs/threatprevention/8.1/admin/agents/agents-windows/configureautodeploy.md). | +| ![Agents Interface - Agent Enrollment Secret icon](/images/threatprevention/8.1/admin/agents/enrollmentsecreticon.webp) | Agent Enrollment Secret | Generate the enrollment secret used to deploy the Agent. Opens the [Enrollment Secret Configuration Window](/docs/threatprevention/8.1/admin/agents/agents-windows/enrollmentsecretconfiguration.md). | +| ![Agents Interface - Deploy Agent icon](/images/threatprevention/8.1/admin/agents/deployagent.webp) | Deploy Agent | Deploy the Agent to selected servers. It opens the Deploy Agents wizard. See the [Deploy Agents](/docs/threatprevention/8.1/admin/agents/deploy/overview.md) topic for additional information. | + +## Right-Click Menu + +Each row in the data grid has a right-click menu. Options that don't apply to the +selected Agent are grayed out. + +![Agents Interface - Right-Click Menu](/images/threatprevention/8.1/admin/agents/rightclickmenu.webp) + +The right-click menu contains the following selections: + +| Right-Click Command | Description | +| ------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| Install Agent | Deploys the Agent to the selected machines. Opens the Deploy Agent wizard. See the [Deploy Agents](/docs/threatprevention/8.1/admin/agents/deploy/overview.md) topic for additional information. | +| Uninstall Agent | Uninstalls a previously deployed Agent from its server. See the [Uninstall Agent](/docs/threatprevention/8.1/install/upgrade/uninstallagent.md) topic for additional information. | +| Upgrade Agent | Upgrades the Agent to a newer version. See the [Upgrade Agent](/docs/threatprevention/8.1/install/upgrade/agent.md) topic for additional information. | +| Upgrade ADMonitor | Updates the SI.ActiveDirectoryMonitor.dll (LSASS module) only rather than the entire Agent. See the [Upgrade ADMonitor](/docs/threatprevention/8.1/admin/agents/agent-management/upgradeadmonitor.md) topic for additional information. | +| Update Agent Settings | Allows for modification of the Agent settings, such as the modules, Enterprise Manager address, or enabling/disabling the DNS Host Name Resolution option. It opens the Deploy Agent wizard. See the [Update Agent Settings](/docs/threatprevention/8.1/admin/agents/deploy/overview.md#update-agent-settings) topic for additional information. | +| Start Agent | Starts the Agent service on the selected machines. See the [Start Agent](/docs/threatprevention/8.1/admin/agents/agent-management/start.md) topic for additional information. | +| Stop Agent | Stops the Agent service on the selected machines. See the [Stop Agent](/docs/threatprevention/8.1/admin/agents/agent-management/stop.md) sections for additional information. | +| Start Pending Modules | Starts Agent service modules that didn't start with the Agent due to a change in LSASS (only available on Agents configured to use Safe Mode). See the [Agent Safe Mode](/docs/threatprevention/8.1/admin/agents/safemode.md) topic and the [Start Pending Modules](/docs/threatprevention/8.1/admin/agents/agent-management/startpendingmodules.md) topic for additional information. | +| Harden Agent | Prevents anyone from altering, stopping, or starting an Agent from within the local Service Control Manager. See the [Harden Agent](/docs/threatprevention/8.1/admin/agents/agent-management/harden.md) topic for additional information. | +| Soften Agent | Unlocks the Agent so it can be controlled from within the local Service Control Manager. See the [Soften Agent](/docs/threatprevention/8.1/admin/agents/agent-management/soften.md) topic for additional information. | +| Remove Server from List | Removes a server from the Agent data grid. If the server has a deployed Agent, Threat Prevention adds the server back to the list the next time the Agent sends information to the Enterprise Manager. See the [Remove Server from List](/docs/threatprevention/8.1/admin/agents/agent-management/removeserver.md) topic for additional information. | +| Clear SQLite Agent Queue | When the Agent is unable to communicate with the Enterprise Manager, Agent events queue up in the Agents local SQLite database until the Enterprise Manager is available to accept events. The Clear SQLite Agent Queue option dumps the queue and discards all pending events. See the [Clear SQLite Agent Queue](/docs/threatprevention/8.1/admin/agents/agent-management/clearqueue.md) topic for additional information. | + +For certain actions, you can select multiple Agents in the data grid and perform that action +on all of them. When multi-selection is available for an action, its right-click menu option isn't +grayed out. Agents must be in the same state to +complete a multi-select action (for example, all selected Agents must be stopped to use the Start +action). + +To perform centralized Agent maintenance from the Administration Console, you must have WMI enabled +on the machine where the Agent is installed. The Soften Agent, Harden Agent, and Remove Server from +List actions are an exception. When executing the other commands, the Administration Console uses +WMI to remotely query the registry on the target Agent machines to understand where the Agent +configuration files are located (install path). Next, it uses WMI to stop the Agent service, modify +the configuration files, and restart the Agent. + +See the [Firewall Ports](/docs/threatprevention/8.1/requirements/ports.md) topic for default ports required for WMI +communication. See the Microsoft +[WMI Diagnosis Utility]() +article for additional information. + +## Additional Agent Considerations + +Consider the following: + +- Occasionally a Microsoft Security Bulletin impacting LSASS can interfere with the Agent + instrumentation resulting in LSASS shutting down. The Agent is configured to monitor for an LSASS + process termination shortly after a server reboot. The + [LSASS Process Terminated](/docs/threatprevention/8.1/troubleshooting/lsass.md) alert (Operations alert) triggers + in this event and the Agent stops. As a result, all monitoring/blocking by that Agent stops. + To resolve the issue, either upgrade to the latest version of the Agent or upgrade + SI.ActiveDirectoryMonitor.dll - commonly known as ADMonitor DLL (recommended). See the + [Upgrade ADMonitor](/docs/threatprevention/8.1/admin/agents/agent-management/upgradeadmonitor.md)topic for additional information. + + :::info + Activate an email notification for the _LSASS process terminated_ alert. See + the + [Enable the 'LSASS Process Terminated' Email Alert](/docs/threatprevention/8.1/troubleshooting/lsass.md#enable-the-lsass-process-terminated-email-alert) + topic for additional information. + ::: + + +- In addition to the LSASS process termination check, you can configure the Agent for a Safe Mode. + In Safe Mode, the Agent records the version of the LSASS DLLs that it hooks into during + installation. When you restart an Agent, it compares the DLL versions with the recorded list. If + the versions don't match, the Windows AD Events monitoring module doesn't load. The Agent’s + status in the Agents interface changes to Active (Modules Pending), and all Active Directory + monitoring/blocking by that Agent stops. The 'Agent Started in AD Monitor pending mode' alert + (Operations alert) triggers in this event. To resolve the issue temporarily, the Threat + Prevention administrator should start the pending modules. See the + [Start Pending Modules](/docs/threatprevention/8.1/admin/agents/agent-management/startpendingmodules.md) topic for additional information. Netwrix + also recommends upgrading SI.ActiveDirectoryMonitor.dll (commonly known as ADMonitor DLL) to + resolve the issue permanently. See the [Upgrade ADMonitor](/docs/threatprevention/8.1/admin/agents/agent-management/upgradeadmonitor.md) + topic for additional information. + + :::info + Activate an email notification for this alert. See the + [Enable Agent Started in AD Monitor Pending Mode Email Alert](/docs/threatprevention/8.1/admin/agents/safemode.md#enable-agent-started-in-ad-monitor-pending-mode-email-alert) + topic and the [Agent Safe Mode](/docs/threatprevention/8.1/admin/agents/safemode.md) topic for additional information. + + ::: diff --git a/docs/threatprevention/8.1/admin/agents/safemode.md b/docs/threatprevention/8.1/admin/agents/safemode.md new file mode 100644 index 0000000000..45cecff5e4 --- /dev/null +++ b/docs/threatprevention/8.1/admin/agents/safemode.md @@ -0,0 +1,105 @@ +--- +title: "Agent Safe Mode" +description: "Agent Safe Mode" +sidebar_position: 10 +--- + +# Agent Safe Mode + +To collect real-time activity data, the Agent hooks into (intercepts) specific Microsoft APIs in the +LSASS process. Consider the following: + +- Occasionally a Microsoft Security Bulletin impacting LSASS can interfere with the Agent + instrumentation resulting in LSASS shutting down. The Agent is configured to monitor for an LSASS + process termination shortly after a server reboot. The + [LSASS Process Terminated](/docs/threatprevention/8.1/troubleshooting/lsass.md) alert (Operations alert) triggers + in this event and the Agent stops. As a result, all monitoring/blocking by that Agent stops. + To resolve the issue, either upgrade to the latest version of the Agent or upgrade + SI.ActiveDirectoryMonitor.dll - commonly known as ADMonitor DLL (recommended). See the + [Upgrade ADMonitor](/docs/threatprevention/8.1/admin/agents/agent-management/upgradeadmonitor.md)topic for additional information. + + :::info + Activate an email notification for the _LSASS process terminated_ alert. See + the + [Enable the 'LSASS Process Terminated' Email Alert](/docs/threatprevention/8.1/troubleshooting/lsass.md#enable-the-lsass-process-terminated-email-alert) + topic for additional information. + ::: + + +- In addition to the LSASS process termination check, you can configure the Agent for a Safe Mode. + In Safe Mode, the Agent records the version of the LSASS DLLs that it hooks into during + installation. When you restart an Agent, it compares the DLL versions with the recorded list. If + the versions don't match, the Windows AD Events monitoring module doesn't load. The Agent’s + status in the Agents interface changes to Active (Modules Pending), and all Active Directory + monitoring/blocking by that Agent stops. The 'Agent Started in AD Monitor pending mode' alert + (Operations alert) triggers in this event. To resolve the issue temporarily, the Threat + Prevention administrator should start the pending modules. See the + [Start Pending Modules](/docs/threatprevention/8.1/admin/agents/agent-management/startpendingmodules.md) topic for additional information. Netwrix + also recommends upgrading SI.ActiveDirectoryMonitor.dll (commonly known as ADMonitor DLL) to + resolve the issue permanently. See the [Upgrade ADMonitor](/docs/threatprevention/8.1/admin/agents/agent-management/upgradeadmonitor.md) + topic for additional information. + + :::info + Activate an email notification for this alert. See the Enable Agent Started + in AD Monitor Pending Mode Email Alert topic for additional information. + ::: + + +:::tip +In Safe Mode, Threat Prevention prevents only the Active Directory monitoring/blocking module from +loading on the Agent machine every time key LSASS DLLs change. The LSASS process keeps running. +::: + + +:::note +Most Microsoft Security Bulletins that alter LSASS will not interfere with Agent +instrumentation. +::: + + +Active Directory monitoring/blocking doesn't resume until you start the pending modules. To +determine whether the LSASS changes conflict with the Agent instrumentation, start the pending +modules on one domain controller (see the [Start Pending Modules](/docs/threatprevention/8.1/admin/agents/agent-management/startpendingmodules.md) +topic). If there are no issues after five minutes, the changes are unlikely to conflict +with the Agent instrumentation. If you have any concerns about the changes, contact +[](mailto:support@stealthbits.com)[Netwrix Support](https://www.netwrix.com/support.html) for more +information. Netwrix tests Microsoft Security Bulletins affecting LSASS before they become +public and notifies Threat Prevention users when it identifies an issue. + +When you start the pending modules, the Agent overwrites the recorded versions of the LSASS DLLs it +hooks into with the current versions. + +## Enable Agent Started in AD Monitor Pending Mode Email Alert + +To enable email notifications for the Agent Started in AD Monitor pending mode +Operations alert: + +:::note +These steps require the Threat Prevention administrator role. They also assume that you have +configured the +[System Alerting Window](/docs/threatprevention/8.1/admin/configuration/systemalerting/overview.md) and enabled email +alerts. +::: + + +**Step 1 –** Clck **Configuration** > **Alerts** on the menu. The Netwrix Threat Prevention System +Alerting window opens. + +**Step 2 –** On the Email tab, click **Configure**. + +**Step 3 –** Create a message profile for the Safe Mode notification with the recipients you want to +notify when the AD modules are pending. See the +[Create Message Profiles](/docs/threatprevention/8.1/admin/configuration/systemalerting/email.md#create-message-profiles) topic +for additional information. + +![Netwrix Threat Prevention System Alerting window](/images/threatprevention/8.1/admin/agents/adpendingmodealert.webp) + +**Step 4 –** Select **Events**, and then **Operations** on the left. Check the **Agent Started in AD +Monitor pending mode** event alert and select the message profile you created in Step 3 from the +dropdown menu to assign it to the alert. See the +[Email Tab](/docs/threatprevention/8.1/admin/configuration/systemalerting/email.md) topic for additional information. + +**Step 5 –** Ensure that the email alerts are **Enabled** and click **OK**. + +When the Agent Started in AD Monitor pending mode event alert triggers, Threat Prevention sends an +email notification to the recipients in the selected message profile. diff --git a/docs/threatprevention/8.1/admin/alerts/_category_.json b/docs/threatprevention/8.1/admin/alerts/_category_.json new file mode 100644 index 0000000000..e52c1d2584 --- /dev/null +++ b/docs/threatprevention/8.1/admin/alerts/_category_.json @@ -0,0 +1,10 @@ +{ + "label": "Alerts Interface", + "position": 50, + "collapsed": true, + "collapsible": true, + "link": { + "type": "doc", + "id": "overview" + } +} \ No newline at end of file diff --git a/docs/threatprevention/8.1/admin/alerts/alertscleanup.md b/docs/threatprevention/8.1/admin/alerts/alertscleanup.md new file mode 100644 index 0000000000..e726ed4199 --- /dev/null +++ b/docs/threatprevention/8.1/admin/alerts/alertscleanup.md @@ -0,0 +1,50 @@ +--- +title: "Alerts Cleanup Window" +description: "Alerts Cleanup Window" +sidebar_position: 10 +--- + +# Alerts Cleanup Window + +You can clear alert data displayed on the [Alerts Interface](/docs/threatprevention/8.1/admin/alerts/overview.md) as well as schedule +cleanups for this data. + +:::info +Export alert data before using the Clear option. See the +[Alerts Export Window](/docs/threatprevention/8.1/admin/alerts/alertsexport.md) topic for additional information. +::: + + +To clear the alerts data: + +**Step 1 –** Click **Alerts** in the left pane to launch the Alerts interface. + +**Step 2 –** On the Alerts interface, click the **Clear** icon in the top right corner. + +![Alerts Cleanup window](/images/threatprevention/8.1/admin/alerts/window/alertscleanup.webp) + +**Step 3 –** The Alerts Cleanup window has these options: + +- Delete – Removes alert data from the database. Select **All** to delete all alert data or select + **Older than** and specify a certain number of days to delete alerts older than the specified + number of days. +- Log Level – Deletes alerts that have the log levels that are checked. The log levels are + equivalent to the alert severity levels in the data grid on the + [Alerts Interface](/docs/threatprevention/8.1/admin/alerts/overview.md). +- Save deleted to File – Saves alert data to a CSV file before Threat Prevention deletes it from the database. On + clicking Start, the Save As window appears. Specify a file name and location; the default name is + “Alerts*Backup*[date]\_[timestamp]”. Then click Save. +- Analytics Alerts – Choose to display Threat Prevention analytics alerts in the database and/or + show them in the Alerts interface. If you choose to display them on the Alerts interface, the + cleanup function also deletes this data. +- Cleanup Scheduling – Deletes alerts after a specific number of days if you select the severity + level from the list. Set the start time for when the cleanup begins. + +**Step 4 –** Click **Start** to run the alerts cleanup with the applied settings. + +**Step 5 –** Click **Save** to save any changes or **Close** to discard the changes and close the +window. + +Threat Prevention clears alert data from the database according to these configurations. It +generates a new alert that reports the cleared alert data, identifies the user who cleared the +alerts, and displays a date timestamp and the options you configured for the cleanup operation. diff --git a/docs/threatprevention/8.1/admin/alerts/alertsexport.md b/docs/threatprevention/8.1/admin/alerts/alertsexport.md new file mode 100644 index 0000000000..19f628bce8 --- /dev/null +++ b/docs/threatprevention/8.1/admin/alerts/alertsexport.md @@ -0,0 +1,29 @@ +--- +title: "Alerts Export Window" +description: "Alerts Export Window" +sidebar_position: 20 +--- + +# Alerts Export Window + +You can export alert data displayed on the Alerts interface to a CSV file. + +To export the alerts data: + +**Step 1 –** Click **Alerts** in the left pane to launch the Alerts interface. + +**Step 2 –** On the Alerts interface, click the **Export Data** icon in the top right corner. The +Alerts Export window opens. + +![Alerts Export window](/images/threatprevention/8.1/admin/alerts/window/export.webp) + +**Step 3 –** Export options include: + +- All – Exports all alert data +- Displayed – Exports alert data according to the filters set in the data grid on the + Alerts interface +- Data Range – Exports alert data generated during the time period you specify in the **From** and + **To** boxes + +**Step 4 –** Click **OK**; the Save As window opens. Specify the file name and location, then click +**Save**. diff --git a/docs/threatprevention/8.1/admin/alerts/overview.md b/docs/threatprevention/8.1/admin/alerts/overview.md new file mode 100644 index 0000000000..111169e149 --- /dev/null +++ b/docs/threatprevention/8.1/admin/alerts/overview.md @@ -0,0 +1,126 @@ +--- +title: "Alerts Interface" +description: "Alerts Interface" +sidebar_position: 50 +--- + +# Alerts Interface + +Use the Alerts interface to view recent Security events, Operations events, and +Configuration events for Threat Prevention - all of which are known as alerts. These events are +system-generated and don't require any prior configuration. + +You can choose to view alerts related to analytics configuration and monitoring status on the Alerts +interface. See the [Alerts Cleanup Window](/docs/threatprevention/8.1/admin/alerts/alertscleanup.md) topic for options to display +this data. + +Click **Alerts** in the left pane to launch the Alerts interface. + +![Alerts interface](/images/threatprevention/8.1/admin/alerts/alertsinterface.webp) + +The following options are available on the toolbar: + +- Recent [number] Alerts radio button – Populates the data grid with the most recent alerts. Use the + textbox to change the default number of 1000. +- Alerts for Last [number] Hours radio button – Populates the data grid with hourly alert data. Use + the textbox to change the default number of three hours. +- Refresh button – Updates the data grid with the current alert data for the selected radio button + option +- Clear icon – Delete, save, and schedule cleanups for alert data +- Export Data icon – Export alerts data from this grid to a local CSV file + +Example for the Alerts for Last [number] Hours Option + +The following example shows how to use the Alerts for Last [number] Hours option. + +Threat Prevention bases the number of hours on UTC and adjusts it for the time zones of the +Administration Console server and the Agent that is monitoring the events. Let's assume the +following: + +- The Administration Console server is in New York, USA (UTC -5) +- The option is set to display events for Last 4 Hours +- The Agent that is monitoring the events is in London, UK (UTC +0) + +If you click the Refresh button at noon New York time, the interface displays events generated +between 8 A.M. and 12 P.M. New York time, or between 1 P.M. and 5 P.M. London time. + +## Alerts Data Grid + +The data grid displays the following information for each event: + +- Time (UTC) – Date timestamp for when the system event occurred, the specified time is UTC time. + Hover over the data in this column to view the local time (of the Enterprise Manager) and UTC time + simultaneously. +- Severity – Classification of the significance of the event indicated by the alert: + - Critical – Might include data loss or other events with unexpected conditions + - Error – Indicates a situation where Threat Prevention fails to complete an operation, for + example, when it fails to connect to a SEIM server + - Warning – Indicates change events that affect the global operations of Threat Prevention + - Info – Covers all other system events +- Component – The type of system event that triggers the alert: + + - Threat Prevention Security events + - Threat Prevention Operations events + - Threat Prevention Configuration events + + For a list of the events that fall under each component, see the + [System Alerting Window](/docs/threatprevention/8.1/admin/configuration/systemalerting/overview.md) + +- Machine – Name of the originating host +- Alert – Name of the event that triggered the alert +- User – Security principal of the account that triggered the event +- Message – Description and details about the event. The **Policy updated on server + Changeset #[number]** link displays for events that represent a change to a policy, be it a + policy under the Policies node or one defined for analytics. Click it to open the + [Policy Comparison Window](/docs/threatprevention/8.1/admin/alerts/policycomparison.md) where you can view any changes made to the + policy. Alerts generated for an archive database maintenance job have "Archive DB:" as the message + prefix to differentiate them from those generated for the database maintenance job. + +This data grid employs features for sorting, filtering, searching, and more. See the +[ Data Grid Functionality](/docs/threatprevention/8.1/admin/navigation/datagrid.md) topic for additional information. + +Select an event in the data grid to view its details. + +In addition to this information, the details list the notifications Threat Prevention sent for the +event. + +## Additional Considerations + +Consider the following: + +- Occasionally a Microsoft Security Bulletin impacting LSASS can interfere with the Agent + instrumentation resulting in LSASS shutting down. The Agent is configured to monitor for an LSASS + process termination shortly after a server reboot. The + [LSASS Process Terminated](/docs/threatprevention/8.1/troubleshooting/lsass.md) alert (Operations alert) triggers + in this event and the Agent stops. As a result, all monitoring/blocking by that Agent stops. + To resolve the issue, either upgrade to the latest version of the Agent or upgrade + SI.ActiveDirectoryMonitor.dll - commonly known as ADMonitor DLL (recommended). See the + [Upgrade ADMonitor](/docs/threatprevention/8.1/admin/agents/agent-management/upgradeadmonitor.md)topic for additional information. + + :::info + Activate an email notification for the _LSASS process terminated_ alert. See + the + [Enable the 'LSASS Process Terminated' Email Alert](/docs/threatprevention/8.1/troubleshooting/lsass.md#enable-the-lsass-process-terminated-email-alert) + topic for additional information. + ::: + + +- In addition to the LSASS process termination check, you can configure the Agent for a Safe Mode. + In Safe Mode, the Agent records the version of the LSASS DLLs that it hooks into during + installation. When you restart an Agent, it compares the DLL versions with the recorded list. If + the versions don't match, the Windows AD Events monitoring module doesn't load. The Agent’s + status in the Agents interface changes to Active (Modules Pending), and all Active Directory + monitoring/blocking by that Agent stops. The 'Agent Started in AD Monitor pending mode' alert + (Operations alert) triggers in this event. To resolve the issue temporarily, the Threat + Prevention administrator should start the pending modules. See the + [Start Pending Modules](/docs/threatprevention/8.1/admin/agents/agent-management/startpendingmodules.md) topic for additional + information. Netwrix also recommends upgrading SI.ActiveDirectoryMonitor.dll (commonly known as + ADMonitor DLL) to resolve the issue permanently. See the + [Upgrade ADMonitor](/docs/threatprevention/8.1/admin/agents/agent-management/upgradeadmonitor.md) topic for additional information. + + :::info + Activate an email notification for this alert. See the + [Enable Agent Started in AD Monitor Pending Mode Email Alert](/docs/threatprevention/8.1/admin/agents/safemode.md#enable-agent-started-in-ad-monitor-pending-mode-email-alert) + topic and the [Agent Safe Mode](/docs/threatprevention/8.1/admin/agents/safemode.md) topic for additional information. + + ::: diff --git a/docs/threatprevention/8.1/admin/alerts/policycomparison.md b/docs/threatprevention/8.1/admin/alerts/policycomparison.md new file mode 100644 index 0000000000..4d51875e2e --- /dev/null +++ b/docs/threatprevention/8.1/admin/alerts/policycomparison.md @@ -0,0 +1,41 @@ +--- +title: "Policy Comparison Window" +description: "Policy Comparison Window" +sidebar_position: 30 +--- + +# Policy Comparison Window + +When you edit a policy, the change creates an alert in the Alerts interface. You can track the +policy changes by comparing the new xml with the old xml. Threat Prevention +uses fc.exe to do a comparison but you can also employ a third party comparison tool for better +results. + +To run a comparison: + +**Step 1 –** Click **Alerts** in the left pane to launch the Alerts interface. + +**Step 2 –** On the Alerts interface, click the **Policy updated on server Changeset #[number]** +link in the Message column for an alert. The Policy Comparison window opens, where you can view the +changes made to the policy against the respective alert. + +![olicy Comparison window ](/images/threatprevention/8.1/admin/alerts/window/policycomparison.webp) + +**Step 3 –** On the Policy Comparison windowthe old xml displays on the left and the modified xml on +the right. + +**Step 4 –** _(Optional)_ Click the **Configure** icon next to the Run Different Tool button. The +File Comparison Tool window opens. In the Path to Comparison Tool box, provide the path to the file +comparison tool location in quotations. Next, add **%1 %2** after the quoted location path. for +example, _cmd.exe /K fc.exe %1 %2_. Click **OK** to close the window. + +:::note +By default, the path points to fc.exe. Netwrix recommends replacing it with a +path to a Windows-based comparison tool such as Beyond Compare for best results. +::: + + +**Step 5 –** On the Policy Comparison window, click **Run Difference Tool** to run the specified +compare command using the third party comparison tool. + +A window displays the policy comparison results. diff --git a/docs/threatprevention/8.1/admin/analytics/_category_.json b/docs/threatprevention/8.1/admin/analytics/_category_.json new file mode 100644 index 0000000000..0c8210da2c --- /dev/null +++ b/docs/threatprevention/8.1/admin/analytics/_category_.json @@ -0,0 +1,10 @@ +{ + "label": "Analytics Interface", + "position": 70, + "collapsed": true, + "collapsible": true, + "link": { + "type": "doc", + "id": "overview" + } +} \ No newline at end of file diff --git a/docs/threatprevention/8.1/admin/analytics/baduseridsourcehost.md b/docs/threatprevention/8.1/admin/analytics/baduseridsourcehost.md new file mode 100644 index 0000000000..ed158de839 --- /dev/null +++ b/docs/threatprevention/8.1/admin/analytics/baduseridsourcehost.md @@ -0,0 +1,150 @@ +--- +title: "Bad User ID (by Source Host)" +description: "Bad User ID (by Source Host) Analytic Type" +sidebar_position: 10 +--- + +# Bad User ID (by Source Host) Analytic Type + +The **Bad User ID (by source host)** analytic type identifies pre-authentication failures due to +using account names that don't exist in Active Directory. Threat Prevention groups these incidents +per source host. Every time a previously unseen machine is the source of a failed login due to a bad +user name, Threat Prevention stores an incident in the database. The attempt count increments each +time that same machine attempts to authenticate with a bad user name, until the specified day limit +expires. After the time expires, any additional attempt generates a new incident. This lets you +report on the number of times a particular host used bad user accounts to try to log in during +the time frame. + +:::info +Configure the day limit to 30 days. +::: + + +| Bad User ID (by source host) | | +| ---------------------------- | -------------------------- | +| Definition | Pre-authentication failures using one or more non-existing user IDs | +| Example | Similar to the “Bad User ID (by User)” analytic type, this analytic looks for multiple failed authentications against non-existing accounts, but from a single source host. This analytic identifies a perpetrator that hunts for accounts from a single source computer. | +| Trigger | Any number of failed authentication attempts using non-existing accounts made from a specific host | +| Recommended Settings | Bad User ID (by source host) groups attacks by where failed authentication attempts by non-existing accounts are coming from to trigger analytic hits. The user-configurable parameter is based on time, where time is used to visualize how often an attempt is made to authenticate using a non-existing account from an individual system.
Netwrix recommends setting the default value to 30 days. If a failed authentication attempt using a non-existing account occurs from the same host after the 30 day time period, a new analytic hit will be produced rather than incrementing the previous hit count. | + +**Analytic Workflow** + +1. Configure the analytic policy +2. Enable the analytic policy +3. Enable alerting on incidents through the + [System Alerting Window](/docs/threatprevention/8.1/admin/configuration/systemalerting/overview.md). + +See the Bad User ID (by Source Host) Analytic Data Grid topic for information on event data +collected per incident. + +## Configure Bad User ID (by Source Host) Analytic Policy + +Open the Bad User ID (by source host) Analytic Policy in any of the following ways: + +- Click Analytics in the left pane to launch the Analytics interface. Then click the gear icon for + the analytic. +- Expand the Analytics node and click the analytic you want. On the analytic window, click the gear + icon available in the top right corner. + +The Configure Analytics window has two tabs: + +- Settings – Where you define the analytic trigger +- Policy – Where you add filters, configure additional actions, set a custom schedule, and enable + the policy + +**Settings Tab** + +![Bad User ID (by Source Host) Analytic Type - Settings tab](/images/threatprevention/8.1/admin/analytics/baduseridsettings.webp) + +Set the Number of Days over which Threat Prevention tallies repeated authentication attempts by a +machine using a bad user account. An incident triggers for every previously unseen host where a +bad user account attempts login. Threat Prevention adds each additional attempt for the same host to +the total number of attempts, through the limit of days you set here, e.g. 30 days. After this +number of days elapses from the first attempt, any additional attempt triggers a new incident with a +new count. + +**Policy Tab** + +![Bad User ID (by Source Host) Analytic Type - Policy tab](/images/threatprevention/8.1/admin/analytics/policytab.webp) + +The Policy tab for configuring analytics consists of three sub-tabs: + +- General tab – Configured the same way a regular policy’s [General Tab](/docs/threatprevention/8.1/admin/policies/configuration/general.md) is + configured. The only exception is that the Name and Description are hard coded, and can't be + modified. The Tags field is disabled for analytics. +- Event Type tab – Configured the same way a regular policy’s + [Event Type Tab](/docs/threatprevention/8.1/admin/policies/configuration/eventtype/overview.md) is configured. The only exception is that the + [Authentication Monitoring Event Type](/docs/threatprevention/8.1/admin/policies/configuration/eventtype/authenticationmonitoring.md) is hard + coded, and the Success filter can't be modified. Additionally, there is no AD Perpetrator filter. + + - _Optional:_ Scope the protocol to monitor on the Authentication Protocol filter. If you + enable the analytic on a domain controller, also scope the login type. + + :::note + The Exclude failed authentications with ‘N-2’ passwords option requires a GPO + within the organization configured to ‘Enforce password history’ with a setting of a + minimum of ‘3 passwords remembered’. Otherwise, the option has no effect. + ::: + + + - _Optional:_ Scope the domains to include in or exclude from monitoring on the + Domains/Servers filter. + - _Optional:_ Scope the servers to include in or exclude from monitoring on the IP + Addresses (from) filter, the IP Addresses (to) filter, the Hosts (from) filter, or the Hosts + (to) filter. + + :::note + Some authentication events may return only a host name (NetBIOS or FQDN), others + may return only an IP address. Take this into account when entering + filter values. + ::: + + +- Actions tab – Configured the same way a regular policy’s + [Actions Tab](/docs/threatprevention/8.1/admin/policies/configuration/actions/overview.md) is configured. The only exceptions are that the + “Send to Event DB” and “Email Notifications” options are disabled. Analytic policies store the + event data they collect in memory until an incident triggers. Use _caution_ with the “Send Raw + Data to SIEM” option, as it sends all event data rather than the triggered incident, which + could be a large volume of data. To send notifications on incidents, use the + [System Alerting Window](/docs/threatprevention/8.1/admin/configuration/systemalerting/overview.md) to configure Email and SIEM + alerts. + +## Bad User ID (by Source Host) Analytic Data Grid + +The data grid on the **Bad User ID (by source host)** node lists one row per incident identified. +Threat Prevention groups these incidents per unique source machine. + +![Bad User ID by Source Host window](/images/threatprevention/8.1/admin/analytics/baduseridsourcehost.webp) + +You can filter the data grid according to the Event Tracker status: All, New, or Reviewed. See the +[Event Tracker Window](/docs/threatprevention/8.1/admin/policies/configuration/recentevents/eventtracker.md) topic for additional information. + +The top data grid includes the following information for each incident: + +- Attacking Host – Name of the originating host +- Attacking Host IP Address – IP address of the originating host +- Last Attempt – Date timestamp of the last event that triggered the incident. Hover over the data + in this column to view the local time (of the Enterprise Manager) and UTC time simultaneously. +- Number of Accounts – Number of unique accounts that attempted to login from this host +- Protocols – Protocols used for the monitored operation +- Number of Attempts – Number of attempts monitored during the specified interval matching this rule +- Number of Hosts – Number of hosts accessed during the specified interval matching this rule + +Select an incident in the top data grid to view information on the events that triggered the +incident: + +- Account Name – Name of the bad user account that attempted to login +- To Host – Name of the target host +- To Host IP Address – IP address of the target host +- Protocol – Protocols used for the monitored operation +- Access Type – Type of authentication, e.g. RDP, CIFS, etc. +- Status – Detailed information on the error generated by the event +- Detected on DC – Fully-qualified name of the domain controller that detected the event +- Events Count – Number of identical events that occurred in one minute +- Date/Time – Date timestamp of the monitored event. Hover over the data in this column to view the + local time (of the Enterprise Manager) and UTC time simultaneously. +- Agent Time Logged – Timestamp for when the Agent detected the event. This can be different from + the Enterprise Manager time (displayed in the Date/Time column) due to latency. + +This data grid employs features for sorting, filtering, searching, and more. See the +[ Data Grid Functionality](/docs/threatprevention/8.1/admin/navigation/datagrid.md) topic for additional information. diff --git a/docs/threatprevention/8.1/admin/analytics/baduseriduser.md b/docs/threatprevention/8.1/admin/analytics/baduseriduser.md new file mode 100644 index 0000000000..398a292b1e --- /dev/null +++ b/docs/threatprevention/8.1/admin/analytics/baduseriduser.md @@ -0,0 +1,148 @@ +--- +title: "Bad User ID (by User)" +description: "Bad User ID (by User) Analytic Type" +sidebar_position: 20 +--- + +# Bad User ID (by User) Analytic Type + +The **Bad User ID (by user)** analytic type identifies pre-authentication failures due to using +account names that don't exist in Active Directory. Threat Prevention groups these incidents per +account name. Every time a previously unseen user that doesn't exist attempts to log in within the +specified day limit, Threat Prevention stores an incident in the database. The attempt count +increments each time that same bad user account attempts to log in, until the specified day limit +expires. After the time expires, any additional attempt generates a new incident. This lets you +report on the number of times a particular bad user account tried to log in during the time +frame. + +:::info +Configure the day limit to 30 days. +::: + + +| Bad User ID (by user) | | +| --------------------- | ---------------------- | +| Definition | Pre-authentication failures using one or more non-existing user IDs | +| Example | Malware or a bad-actor is attempting to obtain access by guessing a user ID and password but has provided a user ID that doesn't exist. Most operating systems and devices have default administrative accounts such as “administrator” or “admin”. Because the account name is known, if left unchanged, the account becomes vulnerable to attack. To prevent this, most organizations change the name of these accounts. In the case where the account has been renamed, a perpetrator attempting to hack a well-known account will actually be attempting to authenticate against an account that doesn't exist and will be detected by this analytic. This analytic looks for attacks, regardless of source, against non-existing accounts. | +| Trigger | Any number of failed authentication attempts made by a non-existing account | +| Recommended Settings | Bad User ID (by user) groups attacks by account name where every new non-existing account will generate an analytic hit. The user-configurable parameter is based on time, where time is used to visualize how often an attempt is made to authenticate using the same non-existing account name.
Netwrix recommends setting the default value to 30 days. If an attempt to use that same non-existing account name occurs after the 30 day time period, a new analytic hit will be produced rather than incrementing the previous hit count. | + +**Analytic Workflow** + +1. Configure the analytic policy +2. Enable the analytic policy +3. Enable alerting on incidents through the + [System Alerting Window](/docs/threatprevention/8.1/admin/configuration/systemalerting/overview.md). + +See the Bad User ID (by User) Analytic Data Grid topic for information on event data collected per +incident. + +## Configure Bad User ID (by User) Analytic Policy + +Open the Bad User ID (by user) Analytic Policy in any of the following ways: + +- Click Analytics in the left pane to launch the Analytics interface. Then click the gear icon for + the analytic. +- Expand the Analytics node and click the analytic you want. On the analytic window, click the gear + icon available in the top right corner. + +The Configure Analytics window has two tabs: + +- Settings – Where you define the analytic trigger +- Policy – Where you add filters, configure additional actions, set a custom schedule, and enable + the policy + +**Settings Tab** + +![Bad User ID (by User) Analytic Type - Settings tab](/images/threatprevention/8.1/admin/analytics/baduseridsettings.webp) + +Set the **Number of Days** over which Threat Prevention tallies repeated use of the same bad user +account. An incident triggers for every previously unseen bad user account that attempts login. +Threat Prevention adds each additional attempt for the same bad user account to the total number of +attempts, through the limit of days you set here, e.g. 30 days. After this number of days elapses +from the first attempt, any additional attempt triggers a new incident with a new count. + +**Policy Tab** + +![Bad User ID (by User) Analytic Type - Policy tab](/images/threatprevention/8.1/admin/analytics/policytab.webp) + +The **Policy** tab for configuring analytics consists of three sub-tabs: + +- General tab – Configured the same way a regular policy’s [General Tab](/docs/threatprevention/8.1/admin/policies/configuration/general.md) is + configured. The only exception is that the Name and Description are hard coded, and can't be + modified. The Tags field is disabled for analytics. +- Event Type tab – Configured the same way a regular policy’s + [Event Type Tab](/docs/threatprevention/8.1/admin/policies/configuration/eventtype/overview.md) is configured. The only exception is that the + [Authentication Monitoring Event Type](/docs/threatprevention/8.1/admin/policies/configuration/eventtype/authenticationmonitoring.md) is hard + coded, and the Success filter can't be modified. Additionally, there is no AD Perpetrator filter. + + - *Optional:* Scope the protocol to monitor on the Authentication Protocol filter. If you + enable the analytic on a domain controller, also scope the login type. + + :::note + The Exclude failed authentications with ‘N-2’ passwords option requires a GPO + within the organization configured to ‘Enforce password history’ with a setting of a + minimum of ‘3 passwords remembered’. Otherwise, the option has no effect. + ::: + + + - _Optional:_ Scope the domains to include in or exclude from monitoring on the + Domains/Servers filter. + - _Optional:_ Scope the servers to include in or exclude from monitoring on the IP + Addresses (from) filter, the IP Addresses (to) filter, the Hosts (from) filter, or the Hosts + (to) filter. + + :::note + Some authentication events may return only a host name (NetBIOS or FQDN), others + may return only an IP address. Take this into account when entering + filter values. + ::: + + +- Actions tab – Configured the same way a regular policy’s + [Actions Tab](/docs/threatprevention/8.1/admin/policies/configuration/actions/overview.md) is configured. The only exceptions are that the + “Send to Event DB” and “Email Notifications” options are disabled. Analytic policies store the + event data they collect in memory until an incident triggers. Use _caution_ with the “Send Raw + Data to SIEM” option, as it sends all event data rather than the triggered incident, which + could be a large volume of data. To send notifications on incidents, use the + [System Alerting Window](/docs/threatprevention/8.1/admin/configuration/systemalerting/overview.md) to configure Email and SIEM + alerts. + +## Bad User ID (by User) Analytic Data Grid + +The data grid on the **Bad User ID (by user)** node lists one row per incident identified. Threat +Prevention groups these incidents per unique bad user name. + +![Bad User ID (by User) Analytic Type window](/images/threatprevention/8.1/admin/analytics/baduseriduser.webp) + +You can filter the data grid according to the Event Tracker status: All, New, or Reviewed. See the +[Event Tracker Window](/docs/threatprevention/8.1/admin/policies/configuration/recentevents/eventtracker.md) topic for additional information. + +The top data grid includes the following information for each incident: + +- Account Name – Name of the bad user account that attempted to login +- Last Attempt – Date timestamp of the last event that triggered the incident. Hover over the data + in this column to view the local time (of the Enterprise Manager) and UTC time simultaneously. +- Protocols – Protocols used for the monitored operation +- Number of Attempts – Number of attempts monitored during the specified interval matching this rule +- Number of Hosts – Number of hosts accessed during the specified interval matching this rule + +Select an incident in the top data grid to view information on the events that triggered the +incident: + +- From Host – Name of the originating host +- From Host IP Address – IP address of the originating host +- To Host – Name of the target host +- To Host IP Address – IP address of the target host +- Protocol – Protocols used for the monitored operation +- Access Type – Type of authentication, e.g. RDP, CIFS, etc. +- Status – Detailed information on the error generated by the event +- Detected on DC – Fully-qualified name of the domain controller that detected the event +- Events Count – Number of identical events that occurred in one minute +- Date/Time – Date timestamp of the monitored event. Hover over the data in this column to view the + local time (of the Enterprise Manager) and UTC time simultaneously. +- Agent Time Logged – Timestamp for when the Agent detected the event. This can be different from + the Enterprise Manager time (displayed in the Date/Time column) due to latency. + +This data grid employs features for sorting, filtering, searching, and more. See the +[ Data Grid Functionality](/docs/threatprevention/8.1/admin/navigation/datagrid.md) topic for additional information. diff --git a/docs/threatprevention/8.1/admin/analytics/breachedpassword.md b/docs/threatprevention/8.1/admin/analytics/breachedpassword.md new file mode 100644 index 0000000000..45cce723b3 --- /dev/null +++ b/docs/threatprevention/8.1/admin/analytics/breachedpassword.md @@ -0,0 +1,157 @@ +--- +title: "Breached Password" +description: "Breached Password Analytic Type" +sidebar_position: 30 +--- + +# Breached Password Analytic Type + +The **Breached Password** analytic type identifies multiple failed authentications followed by a +successful authentication in the specified time frame. + +| Breached Password | | +| -------------------- | ---------------------- | +| Definition | Multiple failed authentications followed by a successful authentication | +| Example | This analytic alert may follow one or more alerts identifying repeated failed authentications against an account. This alert is of special importance as it signals that an attacked account may have been breached and a successful login occurred. This could also identify a scenario where an attacker has attempted multiple authentications with a user’s account but has failed, and then after that, the real user logs in and authenticates successfully. | +| Trigger | X failed authentication attempts from the same account followed by a successful authentication in Y hours | +| Recommended Settings | Netwrix recommends configuring this analytic to trigger a hit if Threat Prevention monitors at least 30 failed authentication attempts from the same account followed by a successful authentication in 4 hours. | + +**Analytic Workflow** + +1. Configure the analytic policy +2. Enable the analytic policy +3. Enable alerting on incidents through the + [System Alerting Window](/docs/threatprevention/8.1/admin/configuration/systemalerting/overview.md). + +See the Breached Password Analytic Data Grid topic for information on event data collected per +incident. + +## Configure Breached Password Analytic Policy + +Open the Breached Password Analytic Policy in any of the following ways: + +- Click Analytics in the left pane to launch the Analytics interface. Then click the gear icon for + the analytic. +- Expand the Analytics node and click the analytic you want. On the analytic window, click the gear + icon available in the top right corner. + +The Configure Analytics window has two tabs: + +- Settings – Where you define the analytic trigger +- Policy – Where you add filters, configure additional actions, set a custom schedule, and enable + the policy + +**Settings Tab** + +![Breached Password Analytic Type - Settings tab](/images/threatprevention/8.1/admin/analytics/breachedpasswordsettings.webp) + +Set the Number of Failed Attempts preceding a successful login and the Interval Duration that +triggers the incident. The interval duration uses (Hours:Minutes) and is capped at 23:59. When +the specified number of failed login attempts for an individual user account precede a successful +login within the specified interval duration, Threat Prevention triggers an incident record. + +By default, Threat Prevention caches authentication event data in memory for 24 hours. When an +incident triggers, Threat Prevention saves an incident record to the database along with the events +that triggered the incident. It purges raw authentication event data that didn't contribute to an +incident from memory once that data is more than 24 hours old. + +**Policy Tab** + +![Breached Password Analytic Type - Policy tab](/images/threatprevention/8.1/admin/analytics/policytab.webp) + +The **Policy** tab for configuring analytics consists of three sub-tabs: + +- General tab – Configured the same way a regular policy’s [General Tab](/docs/threatprevention/8.1/admin/policies/configuration/general.md) is + configured. The only exception is that the Name and Description are hard coded, and can't be + modified. The Tags field is disabled for analytics. +- Event Type tab – Configured the same way a regular policy’s + [Event Type Tab](/docs/threatprevention/8.1/admin/policies/configuration/eventtype/overview.md) is configured. The only exception is that the + [Authentication Monitoring Event Type](/docs/threatprevention/8.1/admin/policies/configuration/eventtype/authenticationmonitoring.md) is hard + coded, and the Success filter can't be modified. + + - Scope the protocol to monitor on the Authentication Protocol filter. If you enable the + analytic on a domain controller, also scope the login type. + + :::note + The Exclude failed authentications with ‘N-2’ passwords option requires a GPO + within the organization configured to ‘Enforce password history’ with a setting of a + minimum of ‘3 passwords remembered’. Otherwise, the option has no effect. + ::: + + + - _Optional:_ Scope the domains to include in or exclude from monitoring on the + Domains/Servers filter. + - _Optional:_ Scope the accounts to include in or exclude from monitoring on the AD + Perpetrator filter. + - _Optional:_ Scope the servers to include in or exclude from monitoring on the IP + Addresses (from) filter, the IP Addresses (to) filter, the Hosts (from) filter, or the Hosts + (to) filter. + + :::note + Some authentication events may return only a host name (NetBIOS or FQDN), others + may return only an IP address. Take this into account when entering + filter values. + ::: + + +- Actions tab – Configured the same way a regular policy’s + [Actions Tab](/docs/threatprevention/8.1/admin/policies/configuration/actions/overview.md) is configured. The only exceptions are that the + “Send to Event DB” and “Email Notifications” options are disabled. Analytic policies store the + event data they collect in memory until an incident triggers. Use _caution_ with the “Send Raw + Data to SIEM” option, as it sends all event data rather than the triggered incident, which + could be a large volume of data. To send notifications on incidents, use the + [System Alerting Window](/docs/threatprevention/8.1/admin/configuration/systemalerting/overview.md) to configure Email and SIEM + alerts. + +## Breached Password Analytic Data Grid + +The data grid on the **Breached Password** node lists one row per incident identified. + +![Breached Password Analytic Type window](/images/threatprevention/8.1/admin/analytics/breachedpassword.webp) + +You can filter the data grid according to the Event Tracker status: All, New, or Reviewed. See the +[Event Tracker Window](/docs/threatprevention/8.1/admin/policies/configuration/recentevents/eventtracker.md) topic for additional information. + +The top data grid includes the following information for each incident: + +- Attacked Account Name – Security principal of the account affected by the event + + :::note + The name displays in red if the attacking account is the Administrator account. + ::: + + +- Attacked Account SID – Security Identifier of the attacked account used in the event +- First Failed Attempt – Date timestamp of the first monitored event that triggered the incident. + Hover over the data in this column to view the local time (of the Enterprise Manager) and UTC time + simultaneously. +- Last Failed Attempt – Date timestamp of the last event that triggered the incident. Hover over the + data in this column to view the local time (of the Enterprise Manager) and UTC time + simultaneously. +- Breach Date – Date timestamp of the first monitored event that succeeded. Hover over the data + in this column to view the local time (of the Enterprise Manager) and UTC time simultaneously. +- Breach Source Host – Name of the originating host +- Breach Source Host IP Address – IP address of the originating host +- Protocols – Protocols used for the monitored operation +- Number of Attempts – Number of attempts monitored during the specified interval matching this rule +- Number of Hosts – Number of hosts accessed during the specified interval matching this rule + +Select an incident in the top data grid to view information on the events thath triggered the +incident: + +- From Host – Name of the originating host +- From Host IP Address – IP address of the originating host +- To Host – Name of the target host +- To Host IP Address – IP address of the target host +- Protocol – Protocols used for the monitored operation +- Access Type – Type of authentication, e.g. RDP, CIFS, etc. +- Status – Detailed information on the error generated by the event +- Detected on DC – Fully-qualified name of the domain controller that detected the event +- Events Count – Number of identical events that occurred in one minute +- Date/Time – Date timestamp of the monitored event. Hover over data in this column to view Local + time (of the Enterprise Manager) and UTC time simultaneously. +- Agent Time Logged – Timestamp for when the Agent detected the event. This can be different from + the Enterprise Manager time (displayed in the Date/Time column) due to latency. + +This data grid employs features for sorting, filtering, searching, and more. See the +[ Data Grid Functionality](/docs/threatprevention/8.1/admin/navigation/datagrid.md) topic for additional information. diff --git a/docs/threatprevention/8.1/admin/analytics/bruteforceattacks.md b/docs/threatprevention/8.1/admin/analytics/bruteforceattacks.md new file mode 100644 index 0000000000..0c8ce3edf7 --- /dev/null +++ b/docs/threatprevention/8.1/admin/analytics/bruteforceattacks.md @@ -0,0 +1,156 @@ +--- +title: "Brute Force Attacks" +description: "Brute Force Attacks Analytic Type" +sidebar_position: 40 +--- + +# Brute Force Attacks Analytic Type + +The **Brute Force Attacks** analytic type identifies failed attempts from a single host to access a +given host. + +:::info +Configure a subset of servers to monitor to avoid the excessive +volume of event activity that monitoring all servers generates. +::: + + +| Brute Force Attacks | | +| -------------------- | ---------------------- | +| Definition | Repeated failed authentications against systems and other network assets in a specified time range | +| Example | Malware or a bad actor on the network is attempting to gain access to a system, application, or data resource such as a file share by sequentially leveraging multiple user accounts and their credentials until they gain access | +| Trigger | X failed logins from a single host against a single host in Y minutes | +| Recommended Settings | Configure this analytic to trigger a hit if Threat Prevention monitors at least 40 failed logins from a single host against a single host in 3 minutes. | + +**Analytic Workflow** + +1. Configure the analytic policy +2. Enable the analytic policy +3. Enable alerting on incidents through the + [System Alerting Window](/docs/threatprevention/8.1/admin/configuration/systemalerting/overview.md). + +See the Brute Force Attacks Analytic Data Grid topic for information on event data collected per +incident. + +## Configure Brute Force Attacks Analytic Policy + +Open the Brute Force Attacks Analytic Policy in any of the following ways: + +- Click Analytics in the left pane to launch the Analytics interface. Then click the gear icon for + the analytic. +- Expand the Analytics node and click the analytic you want. On the analytic window, click the gear + icon available in the top right corner. + +The Configure Analytics window has two tabs: + +- Settings – Where you define the analytic trigger +- Policy – Where you add filters, configure additional actions, set a custom schedule, and enable + the policy + +**Settings Tab** + +![Brute Force Attacks Analytic Type - Settings tab](/images/threatprevention/8.1/admin/analytics/bruteforceattackssettings.webp) + +Set the Number of Failed Attempts preceding a successful login and the Interval Duration that +triggers the incident. The interval duration uses (Hours:Minutes) and is capped at 23:59. When +the specified number of failed logins have occurred from a single host against a single host within +the specified interval duration, Threat Prevention triggers an incident record. + +By default, Threat Prevention caches authentication event data in memory for 24 hours. When an +incident triggers, Threat Prevention saves an incident record to the database along with the events +that triggered the incident. It purges raw authentication event data that didn't contribute to an +incident from memory once that data is more than 24 hours old. + +Click the **Configure Hosts** link to open the **Policy** > **Event Type** > **Hosts (to)** filter. + +If checked, the **Ignore failed logins for unresolved user names** option excludes bad user IDs +from contributing to Brute Force Attacks incidents. + +**Policy Tab** + +![Brute Force Attacks Analytic Type - Policy tab](/images/threatprevention/8.1/admin/analytics/policytab.webp) + +The **Policy** tab for configuring analytics consists of three sub-tabs: + +- General tab – Configured the same way a regular policy’s [General Tab](/docs/threatprevention/8.1/admin/policies/configuration/general.md) is + configured. The only exception is that the Name and Description are hard coded, and can't be + modified. The Tags field is disabled for analytics. +- Event Type tab – Configured the same way a regular policy’s + [Event Type Tab](/docs/threatprevention/8.1/admin/policies/configuration/eventtype/overview.md) is configured. The only exception is that the + [Authentication Monitoring Event Type](/docs/threatprevention/8.1/admin/policies/configuration/eventtype/authenticationmonitoring.md) is hard + coded, and the Success filter can't be modified. + + - Scope the servers to include in or exclude from monitoring on the IP Addresses (from) + filter, the IP Addresses (to) filter, the Hosts (from) filter, or the Hosts (to) filter. + + :::note + Some authentication events may return only a host name (NetBIOS or FQDN), others + may return only an IP address. Take this into account when entering + filter values. + ::: + + + - *Alternatively:* Scope the domains to include in or exclude from monitoring on the + Domains/Servers filter. + - _Optional:_ Scope the protocol to monitor on the Authentication Protocol filter. If you + enable the analytic on a domain controller, also scope the login type. + + :::note + The Exclude failed authentications with ‘N-2’ passwords option requires a GPO + within the organization configured to ‘Enforce password history’ with a setting of a + minimum of ‘3 passwords remembered’. Otherwise, the option has no effect. + ::: + + + - _Optional:_ Scope the accounts to include in or exclude from monitoring on the AD + Perpetrator filter. + +- Actions tab – Configured the same way a regular policy’s + [Actions Tab](/docs/threatprevention/8.1/admin/policies/configuration/actions/overview.md) is configured. The only exceptions are that the + “Send to Event DB” and “Email Notifications” options are disabled. Analytic policies store the + event data they collect in memory until an incident triggers. Use _caution_ with the “Send Raw + Data to SIEM” option, as it sends all event data rather than the triggered incident, which + could be a large volume of data. To send notifications on incidents, use the + [System Alerting Window](/docs/threatprevention/8.1/admin/configuration/systemalerting/overview.md) to configure Email and SIEM + alerts. + +## Brute Force Attacks Analytic Data Grid + +The data grid on the **Brute Force Attacks** node lists one row per incident identified. + +![Brute Force Attacks Analytic Type window](/images/threatprevention/8.1/admin/analytics/bruteforce.webp) + +You can filter the data grid according to the Event Tracker status: All, New, or Reviewed. See the +[Event Tracker Window](/docs/threatprevention/8.1/admin/policies/configuration/recentevents/eventtracker.md) topic for additional information. + +The top data grid includes the following information for each incident: + +- Attacking Host – Name of the originating host +- Attacking Host IP Address – IP address of the originating host +- Attacked Host – Name of the target host +- Attacked Host IP Address – IP address of the target host +- First Attempt – Date timestamp of the first monitored event that triggered the incident. Hover + over the data in this column to view the local time (of the Enterprise Manager) and UTC time + simultaneously. +- Last Attempt – Date timestamp of the last event that triggered the incident. Hover over the data + in this column to view the local time (of the Enterprise Manager) and UTC time simultaneously. +- Number of Attempts – Number of attempts monitored during the specified interval matching this rule +- Protocols – Protocols used for the monitored operation + +Select an incident in the top data grid to view information on the events that triggered the +incident: + +- Account – Security principal of the account that triggered the event +- Account SID – Security Identifier of the account used in the event +- Protocol – Protocols used for the monitored operation +- Access Type – Type of authentication, e.g. RDP, CIFS, etc. +- Status – Detailed information on the error generated by the event +- Detected on DC – Fully-qualified name of the domain controller that detected the event +- Events Count – Number of identical events that occurred in one minute +- Date/Time – Date timestamp of the monitored event. Hover over the data in this column to view the + local time (of the Enterprise Manager) and UTC time simultaneously. +- Agent Time Logged – Timestamp for when the Agent detected the event. This can be different from + the Enterprise Manager time (displayed in the Date/Time column) due to latency. + +This data grid employs features for sorting, filtering, searching, and more. See the +[ Data Grid Functionality](/docs/threatprevention/8.1/admin/navigation/datagrid.md) topic for additional information. diff --git a/docs/threatprevention/8.1/admin/analytics/concurrentlogins.md b/docs/threatprevention/8.1/admin/analytics/concurrentlogins.md new file mode 100644 index 0000000000..6b9034954a --- /dev/null +++ b/docs/threatprevention/8.1/admin/analytics/concurrentlogins.md @@ -0,0 +1,159 @@ +--- +title: "Concurrent Logins" +description: "Concurrent Logins Analytic Type" +sidebar_position: 50 +--- + +# Concurrent Logins Analytic Type + +The **Concurrent Logins** analytic type identifies same account logins from multiple locations +within the specified time frame. + +:::info +Configure a subset of accounts and/or servers to monitor to avoid +the excessive volume of event activity that monitoring all of them generates. +::: + + +| Concurrent Logins | | +| -------------------- | ---------------------------- | +| Definition | Logins from multiple locations simultaneously | +| Example | A user doesn't normally login from multiple locations simultaneously within a short time window. If one or more accounts has been compromised by malware, or if there is an insider attack, one might see a compromised account authenticating from many systems in parallel and a corresponding analytic alert identifying the account and the authenticating systems. | +| Trigger | Successful and failed authentications using the same account from at least X hosts in Y minutes | +| Recommended Settings | Netwrix recommends configuring this analytic to trigger a hit if Threat Prevention monitors either successful or failed authentications using the same account from at least 3 hosts in 1 hour. | + +**Analytic Workflow** + +1. Configure the analytic policy +2. Enable the analytic policy +3. Enable alerting on incidents through the + [System Alerting Window](/docs/threatprevention/8.1/admin/configuration/systemalerting/overview.md). + +See the Concurrent Logins Analytic Data Grid topic for information on event data collected per +incident. + +## Configure Concurrent Logins Analytic Policy + +Open the Concurrent Logins Analytic Policy in any of the following ways: + +- Click Analytics in the left pane to launch the Analytics interface. Then click the gear icon for + the analytic. +- Expand the Analytics node and click the analytic you want. On the analytic window, click the gear + icon available in the top right corner. + +The Configure Analytics window has two tabs: + +- Settings – Where you define the analytic trigger +- Policy – Where you add filters, configure additional actions, set a custom schedule, and enable + the policy + +**Settings Tab** + +![Concurrent Logins Analytic Type - Settings tab](/images/threatprevention/8.1/admin/analytics/concurrentloginssettings.webp) + +Set the Number of Hosts and the Interval Duration that triggers the incident. The interval +duration uses (Hours:Minutes) and is capped at 23:59. When the specified number of hosts have +successful logins by the same individual user account within the specified interval duration, +Threat Prevention triggers an incident record. + +By default, Threat Prevention caches authentication event data in memory for 24 hours. When an +incident triggers, Threat Prevention saves an incident record to the database along with the events +that triggered the incident. It purges raw authentication event data that didn't contribute to an +incident from memory once that data is more than 24 hours old. + +**Policy Tab** + +![Concurrent Logins Analytic Type - Policy tab](/images/threatprevention/8.1/admin/analytics/policytab.webp) + +The **Policy** tab for configuring analytics consists of three sub-tabs: + +- General tab – Configured the same way a regular policy’s [General Tab](/docs/threatprevention/8.1/admin/policies/configuration/general.md) is + configured. The only exception is that the Name and Description are hard coded, and can't be + modified. The Tags field is disabled for analytics. +- Event Type tab – Configured the same way a regular policy’s + [Event Type Tab](/docs/threatprevention/8.1/admin/policies/configuration/eventtype/overview.md) is configured. The only exception is that the + [Authentication Monitoring Event Type](/docs/threatprevention/8.1/admin/policies/configuration/eventtype/authenticationmonitoring.md) is hard + coded, and the Success filter can't be modified. + + - _Optional:_ Scope the protocol to monitor on the Authentication Protocol filter. If you + enable the analytic on a domain controller, also scope the login type. + + :::note + The Exclude failed authentications with ‘N-2’ passwords option requires a GPO + within the organization configured to ‘Enforce password history’ with a setting of a + minimum of ‘3 passwords remembered’. Otherwise, the option has no effect. + ::: + + + - _Optional:_ Scope the domains to include in or exclude from monitoring on the + Domains/Servers filter. + - _Optional:_ Scope the accounts to include in or exclude from monitoring on the AD + Perpetrator filter. + - _Optional:_ Scope the servers to include in or exclude from monitoring on the IP + Addresses (from) filter, the IP Addresses (to) filter, the Hosts (from) filter, or the Hosts + (to) filter. + + :::note + Some authentication events may return only a host name (NetBIOS or FQDN), others + may return only an IP address. Take this into account when entering + filter values. + ::: + + +- Actions tab – Configured the same way a regular policy’s + [Actions Tab](/docs/threatprevention/8.1/admin/policies/configuration/actions/overview.md) is configured. The only exceptions are that the + “Send to Event DB” and “Email Notifications” options are disabled. Analytic policies store the + event data they collect in memory until an incident triggers. Use _caution_ with the “Send Raw + Data to SIEM” option, as it sends all event data rather than the triggered incident, which + could be a large volume of data. To send notifications on incidents, use the + [System Alerting Window](/docs/threatprevention/8.1/admin/configuration/systemalerting/overview.md) to configure Email and SIEM + alerts. + +## Concurrent Logins Analytic Data Grid + +The data grid on the **Concurrent Logins** node lists one row per incident identified. + +![Concurrent Logins Analytic Type window](/images/threatprevention/8.1/admin/analytics/concurrentlogins.webp) + +You can filter the data grid according to the Event Tracker status: All, New, or Reviewed. See the +[Event Tracker Window](/docs/threatprevention/8.1/admin/policies/configuration/recentevents/eventtracker.md) topic for additional information. + +The top data grid includes the following information for each incident: + +- Attacking Account Name – Security principal of the account that triggered the incident + + :::note + The name displays in red if the attacking account is the Administrator account. + ::: + + +- Attacking Account SID – Security Identifier of the account used in the incident-triggering event +- Number of Attacking Hosts – Number of hosts the account used during the specified interval + matching this rule +- First Attempt – Date timestamp of the first monitored event that triggered the incident. Hover + over the data in this column to view the local time (of the Enterprise Manager) and UTC time + simultaneously. +- Last Attempt – Date timestamp of the last event that triggered the incident. Hover over the data + in this column to view the local time (of the Enterprise Manager) and UTC time simultaneously. +- Protocols – Protocols used for the monitored operation +- Number of Attempts – Number of attempts monitored during the specified interval matching this rule + +Select an incident in the top data grid to view information on the events that triggered the +incident: + +- From Host – Name of the originating host +- From Host IP Address – IP address of the originating host +- To Host – Name of the target host +- To Host IP Address – IP address of the target host +- Protocol – Protocols used for the monitored operation +- Access Type – Type of authentication, e.g. RDP, CIFS, etc. +- Status – Detailed information on the error generated by the event +- Detected on DC – Fully-qualified name of the domain controller that detected the event +- Events Count – Number of identical events that occurred in one minute +- Date/Time – Date timestamp of the monitored event. Hover over the data in this column to view the + local time (of the Enterprise Manager) and UTC time simultaneously. +- Agent Time Logged – Timestamp for when the Agent detected the event. This can be different from + the Enterprise Manager time (displayed in the Date/Time column) due to latency. + +This data grid employs features for sorting, filtering, searching, and more. See the +[ Data Grid Functionality](/docs/threatprevention/8.1/admin/navigation/datagrid.md) topic for additional information. diff --git a/docs/threatprevention/8.1/admin/analytics/filesystemattacksuser.md b/docs/threatprevention/8.1/admin/analytics/filesystemattacksuser.md new file mode 100644 index 0000000000..c5263b30a4 --- /dev/null +++ b/docs/threatprevention/8.1/admin/analytics/filesystemattacksuser.md @@ -0,0 +1,230 @@ +--- +title: "File System Attacks (by User)" +description: "File System Attacks (by User) Analytic Type" +sidebar_position: 60 +--- + +# File System Attacks (by User) Analytic Type + +The **File System Attacks (by user)** analytic type identifies activity where a significant number +of file changes made by an account occurred in a short time period. Threat Prevention monitors only +the paths you select. You **MUST** configure at least one path to enable this analytic. Selected +paths are specific to the server you selected them for. + +You can configure the analytic to lock down the monitored file system resource from +‘perpetrators’ who trigger an incident. This feature is only available on Windows file systems. + +| File System Attacks (by user) | | +| ----------------------------- | ------------------------ | +| Definition | Significant number of file changes made by an account in a short time period. Optionally block the perpetrator that triggers an incident by selecting the Enable Automatic Lockdown option. | +| Example | Malware or a bad actor is attempting to delete/modify (such as encrypt) or copy large numbers of files residing locally or on the network, to prevent access to or steal file system data. In the case of a ransomware attack, end user files are typically targeted (such as documents, spreadsheets, presentations, etc.), which is followed by a warning to pay a ransom or the files will be erased. This analytic will identify unusual/abnormally high levels of file activity in a short timeframe, and trigger a file system attack alert as a result. | +| Trigger | X number of files changed by an account in Y minutes | +| Recommended Settings | Netwrix recommends configuring this analytic to trigger a hit if Threat Prevention monitors 500 files affected in 3 minutes. | + +**Analytic Workflow** + +1. Configure the analytic policy +2. Enable the analytic policy +3. Enable alerting on incidents through the + [System Alerting Window](/docs/threatprevention/8.1/admin/configuration/systemalerting/overview.md). + +See the File System Attacks (by User) Analytic Data Grid topic for information on event data +collected per incident. + +## Configure File System Attacks (by User) Analytic Policy + +Open the File System Attacks (by user) Analytic Policy in any of the following ways: + +- Click Analytics in the left pane to launch the Analytics interface. Then click the gear icon for + the analytic. +- Expand the Analytics node and click the analytic you want. On the analytic window, click the gear + icon available in the top right corner. + +The Configure Analytics window has two tabs: + +- Settings – Where you define the analytic trigger +- Policy – Where you add filters, configure additional actions, set a custom schedule, and enable + the policy + +**Settings Tab** + +![File System Attacks (by User) Analytic Type - Settings tab](/images/threatprevention/8.1/admin/analytics/filesystemattackssettings.webp) + +Set the Number of Accessed Files and the Interval Duration that triggers the incident. The +interval duration uses (Hours:Minutes) and is capped at 1:00. When a particular user causes +the specified number of file changes to occur within the specified interval duration, Threat +Prevention triggers an incident record. + +By default, Threat Prevention caches file event data in memory for 1 hour. When an incident +triggers, Threat Prevention saves an incident record to the database along with the events that +triggered the incident. It purges raw file event data that didn't contribute to an incident from +memory once that data is more than 1 hour old. + +After an incident triggers, the next event resets the interval timer. Threat Prevention continues to +add event data to the incident until the incident closes. An incident only closes +once no additional file event data arrives within the specified timeframe. + +You can configure the File System Attacks (by user) Analytic Policy to automatically block +perpetrators who trigger an incident. Check the Enable Automatic Lockdown box and click **Save**. +This adds the File System Lockdown Event Type to the analytic policy. After you enable this +feature, the **Modify Lockdown Perpetrators** link redirects you to the **Policy** > **Event +Type: File System Lockdown** > **AD Perpetrator (for Lockdown)** filter. As incidents occur, Threat +Prevention adds perpetrators of the triggering events to the AD Perpetrators (for Lockdown) filter +list and blocks them from initiating future events. + +**Policy Tab for Monitoring Only** + +![File System Attacks (by User) Analytic Type - Policy tab for Monitoring Only](/images/threatprevention/8.1/admin/analytics/policytabfsmonitoring.webp) + +The **Policy** tab for configuring analytics consists of the following sub-tabs: + +- General tab – Configured the same way a regular policy’s [General Tab](/docs/threatprevention/8.1/admin/policies/configuration/general.md) is + configured. The only exception is that the Name and Description are hard coded, and can't be + modified. The Tags field is disabled for analytics. +- Event Type tab – Configured the same way a regular policy’s + [Event Type Tab](/docs/threatprevention/8.1/admin/policies/configuration/eventtype/overview.md) is configured. For monitoring only, it + contains the File System Changes event type. The only exception is that the Success filter can't + be modified. + + - **Required:** Configure the File System Paths filter for Paths and Path Collections. This + analytic requires that you specify at least one path for file system location monitoring. + You can include and exclude multiple paths and/or collections, along with the option to + monitor sub-folders. + + :::tip + If you don't provide a path, an error message displays when you enable the analytic + policy: The “File System Analytic” policy must have at least one path to monitor defined. + ::: + + + - _Optional:_ Scope the operations to monitor on the File System filter. By default, Threat + Prevention monitors Write and Rename operations. + + :::info + Don't scope to include Read operations due to the quantity of files read + within an organization. + ::: + + + - _Optional:_ Scope the monitoring Agents to use for monitoring on the Additional Agents filter. + - _Optional:_ Scope the accounts to include in or exclude from monitoring on the AD + Perpetrator filter. + +- Actions tab – Configured the same way a regular policy’s + [Actions Tab](/docs/threatprevention/8.1/admin/policies/configuration/actions/overview.md) is configured. The only exceptions are that the + “Send to Event DB” and “Email Notifications” options are disabled. Analytic policies store the + event data they collect in memory until an incident triggers. Use _caution_ with the “Send Raw + Data to SIEM” option, as it sends all event data rather than the triggered incident, which + could be a large volume of data. To send notifications on incidents, use the + [System Alerting Window](/docs/threatprevention/8.1/admin/configuration/systemalerting/overview.md) to configure Email and SIEM + alerts. + +**Policy Tab for Monitoring & Lockdown** + +![File System Attacks (by User) Analytic Type - Policy tab for Monitoring and Lockdown](/images/threatprevention/8.1/admin/analytics/policytabfsmonitoringlockdown.webp) + +When the **Enable Automatic Lockdown** option is selected on the **Settings** tab, the **Policy** +tab > **Event Type** tab includes both the File System Lockdown Event Type and the File System +Changes Event Type. + +The **Policy** tab for configuring analytics consists of the following sub-tabs: + +- General tab – Configured the same way a regular policy’s [General Tab](/docs/threatprevention/8.1/admin/policies/configuration/general.md) is + configured. The only exception is that the Name and Description are hard coded, and can't be + modified. The Tags field is disabled for analytics. +- Event Type tab – Configured the same way a regular policy’s + [Event Type Tab](/docs/threatprevention/8.1/admin/policies/configuration/eventtype/overview.md) is configured. It contains both the + [File System Lockdown Event Type](/docs/threatprevention/8.1/admin/policies/configuration/eventtype/filesystemlockdown.md) and the + [File System Changes Event Type](/docs/threatprevention/8.1/admin/policies/configuration/eventtype/filesystemchanges/filesystemchanges.md). The only exception + is that for the Lockdown Event Type, the File System filter is hard coded to mirror the + configuration of the File System Changes Event Type settings. + + - _Optional:_ Scope the monitoring Agents to use for monitoring on the Additional Agents filter. + - The AD Perpetrator filter for Lockdown auto-populates with perpetrators of the triggering + events. The list is hard coded as a ‘blocking’ list rather than an ‘allow’ list. + + - _Optional:_ Scope the accounts to block additional perpetrators. + - _Optional:_ Remove blocked accounts from the list. + + :::note + Threat Prevention may automatically re-add perpetrators you manually removed + from the list if they trigger another incident + ::: + + +- Actions tab – Configured the same way a regular policy’s + [Actions Tab](/docs/threatprevention/8.1/admin/policies/configuration/actions/overview.md) is configured. The only exceptions are that the + “Send to Event DB” and “Email Notifications” options are disabled. Analytic policies store the + event data they collect in memory until an incident triggers. Use _caution_ with the “Send Raw + Data to SIEM” option, as it sends all event data rather than the triggered incident, which + could be a large volume of data. To send notifications on incidents, use the + [System Alerting Window](/docs/threatprevention/8.1/admin/configuration/systemalerting/overview.md) to configure Email and SIEM + alerts. + +## File System Attacks (by User) Analytic Data Grid + +The data grid on the **File System Attacks (by user)** node lists one row per incident identified. + +![File System Attacks (by User) Analytic Type window](/images/threatprevention/8.1/admin/analytics/fsattacks.webp) + +You can filter the data grid according to the Event Tracker status: All, New, or Reviewed. See the +[Event Tracker Window](/docs/threatprevention/8.1/admin/policies/configuration/recentevents/eventtracker.md) topic for additional information. + +The top data grid includes the following information for each incident: + +- Attacking Account Name – Security principal of the account that triggered the incident + + :::note + The name displays in red if the attacking account is the Administrator account. + ::: + + +- Attacking Account SID – Security Identifier of the account used in the event +- First Attempt – Date timestamp of the first monitored event Hover over the data in this column to + view the local time (of the Enterprise Manager) and UTC time simultaneously. +- Last Attempt – Date timestamp of the last event that triggered the incident Hover over the data in + this column to view the local time (of the Enterprise Manager) and UTC time simultaneously.. +- Number of Files – Number of affected files monitored, sum of both the events which triggered the + incident and the events that have occurred before the incident closes +- Number of Events – Number of events monitored, sum of both the events which triggered the incident + and the events that have occurred before the incident closes +- Attacked Host Count – Number of hosts accessed during the specified interval matching this rule , + sum of both the events that triggered the incident and the events that have occurred before the + incident closes +- Attacked Share Count – Number of affected shares monitored, sum of both the events which triggered + the incident and the events that have occurred before the incident closes +- Primary Attacked Host – Name of the target host with the highest number of events at the time the + incident was triggered. It doesn't update after the incident is triggered. +- Primary Attacked Share – Name of the affected share on the primary attacked host with the highest + number of events at the time the incident was triggered. It doesn't update after the incident is + triggered. +- Primary Attacked Folder – Name of the affected folder on the primary attacked share with the + highest number of events at the time the incident was triggered. It doesn't update after the + incident is triggered. + +Select an incident in the top data grid to view information on the events that triggered the : + +- Agent: Domain – Active Directory domain where the Agent that monitored/blocked the event is + deployed +- Affected Object: Host – Name of the host the security principal is trying to access +- Affected Object: IP Address – IP address of the host where the affected object resides +- Affected Object: Class – Active Directory class of the affected object and indicates if the event + occurred against a file or folder +- Affected Object: Path – Original path of the affected file or folder +- Affected Object: New Path – New path of the affected file or folder +- Event: Name – Type of event monitored/blocked. The event name will be red if the event was blocked + by the auto-blocking feature. +- Perpetrator: Process Name – Identifies remotely accessed objects with “system” or the name of + process for locally accessed objects +- Perpetrator: Host – Name of the originating host +- Perpetrator: IP Address – IP address of the originating host. It will be blank if the affected + host has an operating system older than Windows Server 2008 R2. +- Perpetrator: Protocol – Name of the share where the operation was monitored/blocked. It will be + blank if the affected host has an operating system older than Windows Server 2008 R2. +- Date/Time – Date timestamp of the monitored event. Hover over the data in this column to view the + local time (of the Enterprise Manager) and UTC time simultaneously. +- Agent Time Logged – Timestamp for when the Agent detected the event. This can be different from + the Enterprise Manager time (displayed in the Date/Time column) due to latency. + +This data grid employs features for sorting, filtering, searching, and more. See the +[ Data Grid Functionality](/docs/threatprevention/8.1/admin/navigation/datagrid.md) topic for additional information. diff --git a/docs/threatprevention/8.1/admin/analytics/forgedpac.md b/docs/threatprevention/8.1/admin/analytics/forgedpac.md new file mode 100644 index 0000000000..2230d58dbf --- /dev/null +++ b/docs/threatprevention/8.1/admin/analytics/forgedpac.md @@ -0,0 +1,140 @@ +--- +title: "Forged PAC" +description: "Forged PAC Analytic Type" +sidebar_position: 70 +--- + +# Forged PAC Analytic Type + +The **Forged Privilege Account Certificate** (PAC) analytic type identifies Kerberos tickets with a +modified PAC. By manipulating the PAC, a field in the Kerberos ticket that contains a user’s +authorization data (in Active Directory, this is group membership), an attacker can grant +themselves elevated privileges. + +| Forged PAC | | +| -------------------- | ----------------------------- | +| Definition | Kerberos tickets with modified Privilege Account Certificate (PAC) | +| Example | Kerberos tickets are used as a sort of “pass card” to obtain access to resources. Once a domain controller authenticates a user, a TGT (ticket granting ticket) is granted with a limited lifespan. This is then used to obtain TGS (ticket granting service) and the TGS is what identifies a user to a resource on the network. A known vulnerability exists where PAC part of a ticket can be modified to include groups the user isn't a member of. If a user on the network were to attempt to use such a ticket, this analytic would detect the altered ticket and generate an alert. | +| Trigger | PAC of the ticket contains RIDs that aren't TokenGroups attribute. | +| Recommended Settings | No additional configuration needed | + +**Analytic Workflow** + +1. Configure the analytic policy +2. Enable the analytic policy +3. Enable alerting on incidents through the + [System Alerting Window](/docs/threatprevention/8.1/admin/configuration/systemalerting/overview.md). + +See the Forged PAC Analytic Data Grid topic for information on event data collected per incident. + +## Configure Forged PAC Analytic Policy + +Open the Forged PAC Analytic Policy in any of the following ways: + +- Click Analytics in the left pane to launch the Analytics interface. Then click the gear icon for + the analytic. +- Expand the Analytics node and click the analytic you want. On the analytic window, click the gear + icon available in the top right corner. + +The Configure Analytics window has two tabs: + +- Settings – Where you define the analytic trigger +- Policy – Where you add filters, configure additional actions, set a custom schedule, and enable + the policy + +**Settings Tab** + +![Forged PAC Analytic Type - Settings tab](/images/threatprevention/8.1/admin/analytics/forgedpacsettings.webp) + +The Forged PAC analytic monitors for when the user isn't a member of a group listed in the PAC +section of the user’s Kerberos ticket. You can scope this analytic to monitor +specific groups. To reduce the number of false positives, Threat Prevention only checks for a +mismatch of sensitive groups you specify on the Settings tab. + +You can select specific RIDs that Threat Prevention compares against the PAC and user’s access token +for a mismatch to trigger the incident. + +- Click the **Add** (**+**) button to open the + [Select AD Groups Window](/docs/threatprevention/8.1/admin/policies/configuration/eventtype/window/groups.md), where you + can select the Active Directory groups you want. On selection, Threat Prevention monitors the RID + of that group for modifications. +- The **Remove** (**x**) button removes the selected items from the incident criteria. + +**Policy Tab** + +![Forged PAC Analytic Type - Policy tab](/images/threatprevention/8.1/admin/analytics/policytab.webp) + +The **Policy** tab for configuring analytics consists of three sub-tabs: + +- General tab – Configured the same way a regular policy’s [General Tab](/docs/threatprevention/8.1/admin/policies/configuration/general.md) is + configured. The only exception is that the Name and Description are hard coded, and can't be + modified. The Tags field is disabled for analytics. +- Event Type tab – Configured the same way a regular policy’s + [Event Type Tab](/docs/threatprevention/8.1/admin/policies/configuration/eventtype/overview.md) is configured. The only exception is that the + [Authentication Monitoring Event Type](/docs/threatprevention/8.1/admin/policies/configuration/eventtype/authenticationmonitoring.md) is hard + coded, and the Success filter can't be modified. + + - Scope the servers to include in or exclude from monitoring on the IP Addresses (from) + filter, the IP Addresses (to) filter, the Hosts (from) filter, or the Hosts (to) filter. + + :::note + Some authentication events may return only a host name (NetBIOS or FQDN), others + may return only an IP address. Take this into account when entering + filter values. + ::: + + + - _Alternatively:_ Scope the domains to include in or exclude from monitoring on the + Domains/Servers filter. + - _Optional:_ Scope the protocol to monitor on the Authentication Protocol filter. If you + enable the analytic on a domain controller, also scope the login type. The Authentication + Protocol filter is hard coded to ensure that Threat Prevention monitors the Kerberos protocol. + + :::note + The Exclude failed authentications with ‘N-2’ passwords option requires a GPO + within the organization configured to ‘Enforce password history’ with a setting of a + minimum of ‘3 passwords remembered’. Otherwise, the option has no effect. + ::: + + + - _Optional:_ Scope the accounts to include in or exclude from monitoring on the AD + Perpetrator filter. + +- Actions tab – Configured the same way a regular policy’s + [Actions Tab](/docs/threatprevention/8.1/admin/policies/configuration/actions/overview.md) is configured. The only exceptions are that the + “Send to Event DB” and “Email Notifications” options are disabled. Analytic policies store the + event data they collect in memory until an incident triggers. Use _caution_ with the “Send Raw + Data to SIEM” option, as it sends all event data rather than the triggered incident, which + could be a large volume of data. To send notifications on incidents, use the + [System Alerting Window](/docs/threatprevention/8.1/admin/configuration/systemalerting/overview.md) to configure Email and SIEM + alerts. + +## Forged PAC Analytic Data Grid + +The data grid on the **Forged PAC** node lists one row per incident identified. + +![Forged PAC Analytic Type window](/images/threatprevention/8.1/admin/analytics/forgedpac.webp) + +You can filter the data grid according to the Event Tracker status: All, New, or Reviewed. See the +[Event Tracker Window](/docs/threatprevention/8.1/admin/policies/configuration/recentevents/eventtracker.md) topic for additional information. + +The top data grid includes the following information for each incident: + +- From Host – Name of the originating host +- From Host IP Address – IP address of the originating host +- To Host – Name of the target host +- To Host IP Address –IP address of the target host +- Account Name – Security principal of the account that triggered the incident +- Account SID – Security Identifier of the account used in the incident-triggering event +- Access Type – Type of authentication with encryption, e.g. TGS: cifs/ enc:23/18, TGS: krbtgt/ enc: + 23/18, etc. +- Status – Indication of whether the authentication was successful +- Date/Time – Date timestamp of the monitored event. Hover over the data in this column to view the + local time (of the Enterprise Manager) and UTC time simultaneously. +- Detected on DC – Fully-qualified name of the domain controller that detected the event +- PAC Delta – RID for the group that doesn't have access +- Agent Time Logged – Timestamp for when the Agent detected the event. This can be different from + the Enterprise Manager time (displayed in the Date/Time column) due to latency. + +This data grid employs features for sorting, filtering, searching, and more. See the +[ Data Grid Functionality](/docs/threatprevention/8.1/admin/navigation/datagrid.md) topic for additional information. diff --git a/docs/threatprevention/8.1/admin/analytics/goldenticket.md b/docs/threatprevention/8.1/admin/analytics/goldenticket.md new file mode 100644 index 0000000000..9e7c397608 --- /dev/null +++ b/docs/threatprevention/8.1/admin/analytics/goldenticket.md @@ -0,0 +1,142 @@ +--- +title: "Golden Ticket" +description: "Golden Ticket Analytic Type" +sidebar_position: 80 +--- + +# Golden Ticket Analytic Type + +The **Golden Tickets** analytic type identifies Kerberos tickets that exceed the specified maximum +lifetimes for a user ticket or maximum lifetimes for a user ticket renewal. Every time an account +authenticates, Threat Prevention checks the ticket against the maximum ticket lifetime and maximum +renewals configured within this analytic type. Any ticket that exceeds either ‘maximum’ triggers an +incident. + +| Golden Tickets | | +| -------------------- | ------------------------------ | +| Definition | Kerberos tickets with modified maximum lifetimes for a user ticket and maximum lifetimes for a user ticket renewal | +| Example | Kerberos tickets are used as a sort of “pass card” to obtain access to resources. Once a domain controller authenticates a user, a TGT (ticket granting ticket) is granted with a limited lifespan. This is then used to obtain TGS (ticket granting service) and the TGS is what identifies a user to a resource on the network.
On TGT expiry, the user account is checked for validity (password, enabled/disabled, group memberships, etc.) and a new TGT is granted. A known vulnerability exists where a domain admin could forge the TGT renewal time, creating an indefinite “golden” ticket. This could be accomplished, and then the underlying account removed, allowing the user to obtain admin access forever with an account that no longer exists. If a user on the network were to attempt to use such a ticket, this analytic would detect the altered ticket and generate an alert. | +| Trigger | Maximum lifetime for a user ticket > than X hours
OR
Maximum lifetime for a user ticket renewal > Y days | +| Recommended Settings | Netwrix recommends configuring this analytic to trigger a hit if the maximum lifetime for a user ticket is greater than 24 hours or the maximum lifetime for a user ticket renewal is greater than 30 days. | + +**Analytic Workflow** + +1. Configure the analytic policy +2. Enable the analytic policy +3. Enable alerting on incidents through the + [System Alerting Window](/docs/threatprevention/8.1/admin/configuration/systemalerting/overview.md). + +See the Golden Tickets Analytic Data Grid topic for information on event data collected per +incident. + +## Configure Golden Tickets Analytic Policy + +Open the Golden Tickets Analytic Policy in any of the following ways: + +- Click Analytics in the left pane to launch the Analytics interface. Then click the gear icon for + the analytic. +- Expand the Analytics node and click the analytic you want. On the analytic window, click the gear + icon available in the top right corner. + +The Configure Analytics window has two tabs: + +- Settings – Where you define the analytic trigger +- Policy – Where you add filters, configure additional actions, set a custom schedule, and enable + the policy + +**Settings Tab** + +![Golden Ticket Analytic Type - Settings tab](/images/threatprevention/8.1/admin/analytics/goldenticketsettings.webp) + +Set the _Maximum Lifetime for User Ticket [value] Hours_ and the _Maximum Lifetime for User Ticket +Renewal [value] Days_ to trigger the incident. The default Microsoft Windows lifetime for user +tickets is ten hours, and the renewal period is seven days. This analytic policy checks each +ticket that requests authentication against the values you set in this analytic policy. Any time a +ticket exceeds either of these values, an incident triggers. + +**Policy Tab** + +![Golden Ticket Analytic Type - Policy tab](/images/threatprevention/8.1/admin/analytics/policytab.webp) + +The **Policy** tab for configuring analytics consists of three sub-tabs: + +- General tab – Configured the same way a regular policy’s [General Tab](/docs/threatprevention/8.1/admin/policies/configuration/general.md) is + configured. The only exception is that the Name and Description are hard coded, and can't be + modified. The Tags field is disabled for analytics. +- Event Type tab – Configured the same way a regular policy’s + [Event Type Tab](/docs/threatprevention/8.1/admin/policies/configuration/eventtype/overview.md) is configured. The only exception is that the + [Authentication Monitoring Event Type](/docs/threatprevention/8.1/admin/policies/configuration/eventtype/authenticationmonitoring.md) is hard + coded, and the Success filter can't be modified. + + :::info + Don't configure any filters for this analytic type. + ::: + + + - _Optional:_ Scope the protocol to monitor on the Authentication Protocol filter. If you + enable the analytic on a domain controller, also scope the login type. + + :::note + The Exclude failed authentications with ‘N-2’ passwords option requires a GPO + within the organization configured to ‘Enforce password history’ with a setting of a + minimum of ‘3 passwords remembered’. Otherwise, the option has no effect. + ::: + + + - \_Optional:\_Scope the domains to include in or exclude from monitoring on the + Domains/Servers filter. + - \_Optional:\_Scope the accounts to include in or exclude from monitoring on the AD + Perpetrator filter. + - \_Optional:\_Scope the servers to include in or exclude from monitoring on the IP + Addresses (from) filter, the IP Addresses (to) filter, the Hosts (from) filter, or the Hosts + (to) filter. + + :::note + Some authentication events may return only a host name (NetBIOS or FQDN), others + may return only an IP address. Take this into account when entering + filter values. + ::: + + +- Actions tab – Configured the same way a regular policy’s + [Actions Tab](/docs/threatprevention/8.1/admin/policies/configuration/actions/overview.md) is configured. The only exceptions are that the + “Send to Event DB” and “Email Notifications” options are disabled. Analytic policies store the + event data they collect in memory until an incident triggers. Use _caution_ with the “Send Raw + Data to SIEM” option, as it sends all event data rather than the triggered incident, which + could be a large volume of data. To send notifications on incidents, use the + [System Alerting Window](/docs/threatprevention/8.1/admin/configuration/systemalerting/overview.md) to configure Email and SIEM + alerts. + +## Golden Tickets Analytic Data Grid + +The data grid on the **Golden Tickets** node lists one row per incident identified. + +![Golden Ticket Analytic Type window](/images/threatprevention/8.1/admin/analytics/goldenticket.webp) + +You can filter the data grid according to the Event Tracker status: All, New, or Reviewed. See the +[Event Tracker Window](/docs/threatprevention/8.1/admin/policies/configuration/recentevents/eventtracker.md) topic for additional information. + +The top data grid includes the following information for each incident: + +- From Host – Name of the originating host +- From Host IP Address – IP address of the originating host +- To Host – Name of the target host +- To Host IP Address – IP address of the target host +- Account Name – Security principal of the account that triggered the incident +- Account SID – Security Identifier of the account used in the incident-triggering event +- Access Type – Type of authentication, e.g. RDP, CIFS, etc. +- Status – Indication of whether the authentication was successful +- Date/Time – Date timestamp of the monitored event. Hover over the data in this column to view the + local time (of the Enterprise Manager) and UTC time simultaneously. +- Detected on DC – Fully-qualified name of the domain controller that detected the event +- TGT StartTime – Date timestamp for the start time of the ticket; the specified time is the local + time for the server where the Agent is deployed +- TGT EndTime – Date timestamp for the expiration time of the ticket; the specified time is the + local time for the server where the Agent is deployed +- TGT MaxRenew – Date timestamp for the maximum renewal date of the ticket; the specified time is + the local time for the server where the Agent is deployed +- Agent Time Logged – Timestamp for when the Agent detected the event. This can be different from + the Enterprise Manager time (displayed in the Date/Time column) due to latency. + +This data grid employs features for sorting, filtering, searching, and more. See the +[ Data Grid Functionality](/docs/threatprevention/8.1/admin/navigation/datagrid.md) topic for additional information. diff --git a/docs/threatprevention/8.1/admin/analytics/horizontalmovementattacks.md b/docs/threatprevention/8.1/admin/analytics/horizontalmovementattacks.md new file mode 100644 index 0000000000..7d3278ae49 --- /dev/null +++ b/docs/threatprevention/8.1/admin/analytics/horizontalmovementattacks.md @@ -0,0 +1,160 @@ +--- +title: "Horizontal Movement Attacks" +description: "Horizontal Movement Attacks Analytic Type" +sidebar_position: 90 +--- + +# Horizontal Movement Attacks Analytic Type + +The **Horizontal Movement Attacks** analytic type identifies security principals that are accessing +more than the threshold of resources during the specified time interval. + +:::info +Configure a subset of accounts and/or servers to monitor to avoid +the excessive volume of event activity that monitoring all of them generates. +::: + + +| Horizontal Movement Attacks | | +| --------------------------- | ------------------------------- | +| Definition | User account authentications across multiple network assets in a specified time period | +| Example | Malware uses several techniques to spread its payload during the initial phase of an attack including Pass the Hash, Impersonation, and current session logged on credentials. Regardless of the method, authentication takes place against other targets on the network, triggering a Threat Prevention horizontal movement alert. | +| Trigger | Successful or failed authentications of a given account across X number of resources in Y minutes | +| Recommended Settings | Configure this analytic to trigger a hit if Threat Prevention monitors successful or failed authentications of a given account across 10 resources in 3 minutes. | + +**Analytic Workflow** + +1. Configure the analytic policy +2. Enable the analytic policy +3. Enable alerting on incidents through the + [System Alerting Window](/docs/threatprevention/8.1/admin/configuration/systemalerting/overview.md). + +See the Horizontal Movement Attacks Analytic Data Grid topic for information on event data collected +per incident. + +## Configure Horizontal Movement Attacks Analytic Policy + +Open the Horizontal Movement Attacks Analytic Policy in any of the following ways: + +- Click Analytics in the left pane to launch the Analytics interface. Then click the gear icon for + the analytic. +- Expand the Analytics node and click the analytic you want. On the analytic window, click the gear + icon available in the top right corner. + +The Configure Analytics window has two tabs: + +- Settings – Where you define the analytic trigger +- Policy – Where you add filters, configure additional actions, set a custom schedule, and enable + the policy + +**Settings Tab** + +![Horizontal Movement Attacks Analytic Type - Settings tab](/images/threatprevention/8.1/admin/analytics/horizontalattackssettings.webp) + +Set the Number of Hosts and the Interval Duration to trigger the incident. The interval duration +uses (hours:minutes) and is capped at 23:59. When successful or failed authentications of a given +account occur across the specified number of hosts within the specified interval duration, Threat +Prevention triggers an incident record. + +By default, Threat Prevention caches authentication event data in memory for 24 hours. When an +incident triggers, Threat Prevention saves an incident record to the database along with the events +that triggered the incident. It purges raw authentication event data that didn't contribute to an +incident from memory once that data is more than 24 hours old. + +If checked, the Ignore failed logins for unresolved user names option excludes bad user IDs from +contributing to Horizontal Movement Attacks incidents. + +**Policy Tab** + +![Horizontal Movement Attacks Analytic Type - Policy tab](/images/threatprevention/8.1/admin/analytics/policytab.webp) + +The **Policy** tab for configuring analytics consists of three sub-tabs: + +- General tab – Configured the same way a regular policy’s [General Tab](/docs/threatprevention/8.1/admin/policies/configuration/general.md) is + configured. The only exception is that the Name and Description are hard coded, and can't be + modified. The Tags field is disabled for analytics. +- Event Type tab – Configured the same way a regular policy’s + [Event Type Tab](/docs/threatprevention/8.1/admin/policies/configuration/eventtype/overview.md) is configured. The only exception is that the + [Authentication Monitoring Event Type](/docs/threatprevention/8.1/admin/policies/configuration/eventtype/authenticationmonitoring.md) is hard + coded, and the Success filter can't be modified. + + - Scope the accounts to include in or exclude from monitoring on the AD Perpetrator filter. + - \_Optional:\_Scope the protocol to monitor on the Authentication Protocol filter. If you + enable the analytic on a domain controller, also scope the login type. + + :::note + The Exclude failed authentications with ‘N-2’ passwords option requires a GPO + within the organization configured to ‘Enforce password history’ with a setting of a + minimum of ‘3 passwords remembered’. Otherwise, the option has no effect. + ::: + + + - \_Optional:\_Scope the domains to include in or exclude from monitoring on the + Domains/Servers filter. + - _Optional:_ Scope the servers to include in or exclude from monitoring on the IP + Addresses (from) filter, the IP Addresses (to) filter, the Hosts (from) filter, or the Hosts + (to) filter. + + :::note + Some authentication events may return only a host name (NetBIOS or FQDN), others + may return only an IP address. Take this into account when entering + filter values. + ::: + + +- Actions tab – Configured the same way a regular policy’s + [Actions Tab](/docs/threatprevention/8.1/admin/policies/configuration/actions/overview.md) is configured. The only exceptions are that the + “Send to Event DB” and “Email Notifications” options are disabled. Analytic policies store the + event data they collect in memory until an incident triggers. Use _caution_ with the “Send Raw + Data to SIEM” option, as it sends all event data rather than the triggered incident, which + could be a large volume of data. To send notifications on incidents, use the + [System Alerting Window](/docs/threatprevention/8.1/admin/configuration/systemalerting/overview.md) to configure Email and SIEM + alerts. + +## Horizontal Movement Attacks Analytic Data Grid + +The data grid on the **Horizontal Movement Attacks** node lists one row per incident identified. + +![Horizontal Movement Attacks Analytic Type window](/images/threatprevention/8.1/admin/analytics/horizontalmovement.webp) + +You can filter the data grid according to the Event Tracker status: All, New, or Reviewed. See the +[Event Tracker Window](/docs/threatprevention/8.1/admin/policies/configuration/recentevents/eventtracker.md) topic for additional information. + +The top data grid includes the following information for each incident: + +- Attacking Account Name – Security principal of the account that triggered the incident + + :::note + The name displays in red if the attacking account is the Administrator account. + ::: + + +- Attacking Account SID – Security Identifier of the account used in the event +- First Attempt – Date timestamp of the first monitored event that triggered the incident. Hover + over the data in this column to view the local time (of the Enterprise Manager) and UTC time + simultaneously. +- Last Attempt – Date timestamp of the last event that triggered the incident. Hover over the data + in this column to view the local time (of the Enterprise Manager) and UTC time simultaneously. +- Protocol – Protocols used for the monitored operation +- Number of Attempts – Number of attempts monitored during the specified interval matching this rule +- Number of Hosts – Number of hosts accessed during the specified interval matching this rule + +Select an incident in the top data grid to view information on the events that triggered the +incident: + +- From Host – Name of the originating host +- From Host IP Address – IP address of the originating host +- To Host – Name of the target host +- To Host IP Address – IP address of the target host +- Protocol – Protocols used for the monitored operation +- Access Type – Type of authentication, e.g. RDP, CIFS, etc. +- Status – Detailed information on the error generated by the event +- Detected on DC – Fully-qualified name of the domain controller that detected the event +- Events Count – Number of identical events that occurred in one minute +- Date/Time – Date timestamp of the monitored event. Hover over the data in this column to view the + local time (of the Enterprise Manager) and UTC time simultaneously. +- Agent Time Logged – Timestamp for when the Agent detected the event. This can be different from + the Enterprise Manager time (displayed in the Date/Time column) due to latency. + +This data grid employs features for sorting, filtering, searching, and more. See the +[ Data Grid Functionality](/docs/threatprevention/8.1/admin/navigation/datagrid.md) topic for additional information. diff --git a/docs/threatprevention/8.1/admin/analytics/impersonationlogins.md b/docs/threatprevention/8.1/admin/analytics/impersonationlogins.md new file mode 100644 index 0000000000..a33b93399b --- /dev/null +++ b/docs/threatprevention/8.1/admin/analytics/impersonationlogins.md @@ -0,0 +1,156 @@ +--- +title: "Impersonation Logins" +description: "Impersonation Logins Analytic Type" +sidebar_position: 100 +--- + +# Impersonation Logins Analytic Type + +The **Impersonation Logins** analytic type identifies multiple authenticated accounts from a single +system within the specified time frame. + +:::info +Configure a subset of accounts and/or servers to monitor to avoid +the excessive volume of event activity that monitoring all of them generates. +::: + + +| Impersonation Logins | | +| -------------------- | --------------------------- | +| Definition | Multiple authenticated accounts from a single system | +| Example | A perpetrator may want to mask their activities by authenticating using alternate credentials. While logged in using their primary user ID, the perpetrator will authenticate against a network resource using an alternate ID; this is known as impersonation. Impersonation is often used by administrators, but not normally used by end-users. An attacker will often use impersonation to obtain increased rights to remote systems. This analytic identifies hosts that are using impersonated authentications. | +| Trigger | X different authenticated accounts from a single system in Y hours | +| Recommended Settings | Netwrix recommends configuring this analytic to trigger a hit if Threat Prevention monitors 3 different authenticated accounts from a single system in 2 hours. | + +**Analytic Workflow** + +1. Configure the analytic policy +2. Enable the analytic policy +3. Enable alerting on incidents through the + [System Alerting Window](/docs/threatprevention/8.1/admin/configuration/systemalerting/overview.md). + +See the Impersonation Logins Analytic Data Grid topic for information on event data collected per +incident. + +## Configure Impersonation Logins Analytic Policy + +Open the Impersonation Logins Analytic Policy in any of the following ways: + +- Click Analytics in the left pane to launch the Analytics interface. Then click the gear icon for + the analytic. +- Expand the Analytics node and click the analytic you want. On the analytic window, click the gear + icon available in the top right corner. + +The Configure Analytics window has two tabs: + +- Settings – Where you define the analytic trigger +- Policy – Where you add filters, configure additional actions, set a custom schedule, and enable + the policy + +**Settings Tab** + +![Impersonation Logins Analytic Type - Settings tab](/images/threatprevention/8.1/admin/analytics/concurrentloginssettings.webp) + +Set the Number of Accounts and the Interval Duration to trigger the incident. The interval duration +uses (hours:minutes) and is capped at 23:59. When the specified number of account credentials +different from those used to log into the originating host have accessed services, applications, +remote connections, etc. within the specified interval duration, Threat Prevention triggers an +incident record. + +By default, Threat Prevention caches authentication event data in memory for 24 hours. When an +incident triggers, Threat Prevention saves an incident record to the database along with the events +that triggered the incident. It purges raw authentication event data that didn't contribute to an +incident from memory once that data is more than 24 hours old. + +**Policy Tab** + +![Impersonation Logins Analytic Type - Policy tab](/images/threatprevention/8.1/admin/analytics/policytab.webp) + +The **Policy** tab for configuring analytics consists of three sub-tabs: + +- General tab – Configured the same way a regular policy’s [General Tab](/docs/threatprevention/8.1/admin/policies/configuration/general.md) is + configured. The only exception is that the Name and Description are hard coded, and can't be + modified. The Tags field is disabled for analytics. +- Event Type tab – Configured the same way a regular policy’s + [Event Type Tab](/docs/threatprevention/8.1/admin/policies/configuration/eventtype/overview.md) is configured. The only exception is that the + [Authentication Monitoring Event Type](/docs/threatprevention/8.1/admin/policies/configuration/eventtype/authenticationmonitoring.md) is hard + coded, and the Success filter can't be modified. + + - _Optional:_ Scope the protocol to monitor on the Authentication Protocol filter. If you + enable the analytic on a domain controller, also scope the login type. + + :::note + The Exclude failed authentications with ‘N-2’ passwords option requires a GPO + within the organization configured to ‘Enforce password history’ with a setting of a + minimum of ‘3 passwords remembered’. Otherwise, the option has no effect. + ::: + + + - _Optional:_ – Scope the domains to include in or exclude from monitoring on the + Domains/Servers filter. + - _Optional:_ – Scope the accounts to include in or exclude from monitoring on the AD + Perpetrator filter. + - _Optional:_ – Scope the servers to include in or exclude from monitoring on the IP + Addresses (from) filter, the IP Addresses (to) filter, the Hosts (from) filter, or the Hosts + (to) filter. + + :::note + Some authentication events may return only a host name (NetBIOS or FQDN), others + may return only an IP address. Take this into account when entering + filter values. + ::: + + +- Actions tab – Configured the same way a regular policy’s + [Actions Tab](/docs/threatprevention/8.1/admin/policies/configuration/actions/overview.md) is configured. The only exceptions are that the + “Send to Event DB” and “Email Notifications” options are disabled. Analytic policies store the + event data they collect in memory until an incident triggers. Use _caution_ with the “Send Raw + Data to SIEM” option, as it sends all event data rather than the triggered incident, which + could be a large volume of data. To send notifications on incidents, use the + [System Alerting Window](/docs/threatprevention/8.1/admin/configuration/systemalerting/overview.md) to configure Email and SIEM + alerts. + +## Impersonation Logins Analytic Data Grid + +The data grid on the **Impersonation Logins** node lists one row per incident identified. + +![Impersonation Logins Analytic Type window](/images/threatprevention/8.1/admin/analytics/impersonationlogins.webp) + +You can filter the data grid according to the Event Tracker status: All, New, or Reviewed. See the +[Event Tracker Window](/docs/threatprevention/8.1/admin/policies/configuration/recentevents/eventtracker.md) topic for additional information. + +The top data grid includes the following information for each incident: + +- Attacking Host – Name of the originating host from which a user account logged in +- Attacking Host IP Address – IP address of the originating host +- Number of Accounts – Number of unique accounts that logged in from this host +- Accounts – Security principal of the account that triggered the event for the attempted + impersonation. The column lists all accounts. +- First Attempt – Date timestamp of the first monitored event that triggered the incident. Hover + over the data in this column to view the local time (of the Enterprise Manager) and UTC time + simultaneously. +- Last Attempt – Date timestamp of the last event that triggered the incident. Hover over the data + in this column to view the local time (of the Enterprise Manager) and UTC time simultaneously. +- Protocols – Protocols used for the monitored operation +- Number of Attempts – Number of attempts monitored during the specified interval matching this rule + +Select an incident in the top data grid to view information on the events that triggered the +incident: + +- Account Name – Security principal of the account that triggered the event for the attempted + impersonation +- Account SID – Security Identifier of the account used in the event for the attempted impersonation +- To Host – Name of the target host +- To Host IP Address – IP address of the target host +- Protocol – Protocols used for the monitored operation +- Access Type – Type of authentication, e.g. RDP, CIFS, etc. +- Status – Detailed information on the error generated by the event +- Detected on DC – Fully-qualified name of the domain controller that detected the event +- Events Count – Number of identical events that occurred in one minute +- Date/Time – Date timestamp of the monitored event. Hover over data in this column to view Agent + time, Local time (of the Enterprise Manager), and UTC time simultaneously. +- Agent Time Logged – Timestamp for when the Agent detected the event. This can be different from + the Enterprise Manager time (displayed in the Date/Time column) due to latency. + +This data grid employs features for sorting, filtering, searching, and more. See the +[ Data Grid Functionality](/docs/threatprevention/8.1/admin/navigation/datagrid.md) topic for additional information. diff --git a/docs/threatprevention/8.1/admin/analytics/kerberosweakencryption.md b/docs/threatprevention/8.1/admin/analytics/kerberosweakencryption.md new file mode 100644 index 0000000000..c3ae11b4b5 --- /dev/null +++ b/docs/threatprevention/8.1/admin/analytics/kerberosweakencryption.md @@ -0,0 +1,122 @@ +--- +title: "Kerberos Weak Encryption" +description: "Kerberos Weak Encryption Analytic Type" +sidebar_position: 110 +--- + +# Kerberos Weak Encryption Analytic Type + +The **Kerberos Weak Encryption** analytic type identifies Kerberos tickets with RC4_HMAC_MD5 +encryption by detecting the use of weak encryption. Various attack methods use weak Kerberos +encryption cyphers, including Overpass-the-Hash. + +| Kerberos Weak Encryption | | +| ------------------------ | ---------------------------- | +| Definition | Kerberos tickets with RC4_HMAC_MD5 encryption. | +| Example | Kerberos tickets are used as a sort of “pass card” to obtain access to resources. Once a domain controller authenticates a user, a TGT (ticket granting ticket) is granted with a limited lifespan. This is then used to obtain TGS (ticket granting service) and the TGS is what identifies a user to a resource on the network.
If RC4_HMAC_MD5 encryption is used then it makes possible to obtain password value using Kerberoasting attack. If a user on the network were to attempt to use such a ticket, this analytic would detect this ticket and generate an alert. | +| Trigger | Ticket uses RC4_HMAC_MD5 encryption. | +| Recommended Settings | No additional configuration needed | + +**Analytic Workflow** + +1. Configure the analytic policy +2. Enable the analytic policy +3. Enable alerting on incidents through the + [System Alerting Window](/docs/threatprevention/8.1/admin/configuration/systemalerting/overview.md). + +See the Kerberos Weak Encryption Analytic Data Grid topic for information on event data collected +per incident. + +## Configure Kerberos Weak Encryption Analytic Policy + +Open the Kerberos Weak Encryption Policy in any of the following ways: + +- Click Analytics in the left pane to launch the Analytics interface. Then click the gear icon for + the analytic. +- Expand the Analytics node and click the analytic you want. On the analytic window, click the gear + icon available in the top right corner. + +The Configure Analytics window has one tab: + +- Policy – Where you add filters, configure additional actions, set a custom schedule, and enable + the policy + +**Policy Tab** + +![Kerberos Weak Encryption Analytic Type - Policy tab](/images/threatprevention/8.1/admin/analytics/policytab.webp) + +The **Policy** tab for configuring analytics consists of three sub-tabs: + +- General tab – Configured the same way a regular policy’s [General Tab](/docs/threatprevention/8.1/admin/policies/configuration/general.md) is + configured. The only exception is that the Name and Description are hard coded, and can't be + modified. The Tags field is disabled for analytics. +- Event Type tab – Configured the same way a regular policy’s + [Event Type Tab](/docs/threatprevention/8.1/admin/policies/configuration/eventtype/overview.md) is configured. The only exception is that the + [Authentication Monitoring Event Type](/docs/threatprevention/8.1/admin/policies/configuration/eventtype/authenticationmonitoring.md) is hard + coded, and the Success filter can't be modified. + + - Scope the servers to include in or exclude from monitoring on the IP Addresses (from) + filter, the IP Addresses (to) filter, the Hosts (from) filter, or the Hosts (to) filter. + + :::note + Some authentication events may return only a host name (NetBIOS or FQDN), others + may return only an IP address. Take this into account when entering + filter values. + ::: + + + - *Alternatively:* Scope the domains to include in or exclude from monitoring on the + Domains/Servers filter. + - \_Optional:\_Scope the protocol to monitor on the Authentication Protocol filter. If you + enable the analytic on a domain controller, also scope the login type. The Authentication + Protocol filter is hard coded to ensure that Threat Prevention monitors the Kerberos protocol. + + :::note + The Exclude failed authentications with ‘N-2’ passwords option requires a GPO + within the organization configured to ‘Enforce password history’ with a setting of a + minimum of ‘3 passwords remembered’. Otherwise, the option has no effect. + ::: + + + - _Optional_ – Scope the accounts to include in or exclude from monitoring on the AD + Perpetrator filter. + +- Actions tab – Configured the same way a regular policy’s + [Actions Tab](/docs/threatprevention/8.1/admin/policies/configuration/actions/overview.md) is configured. The only exceptions are that the + “Send to Event DB” and “Email Notifications” options are disabled. Analytic policies store the + event data they collect in memory until an incident triggers. Use _caution_ with the “Send Raw + Data to SIEM” option, as it sends all event data rather than the triggered incident, which + could be a large volume of data. To send notifications on incidents, use the + [System Alerting Window](/docs/threatprevention/8.1/admin/configuration/systemalerting/overview.md) to configure Email and SIEM + alerts. + +## Kerberos Weak Encryption Analytic Data Grid + +The data grid on the **Kerberos Weak Encryption** node lists one row per incident identified. + +![kerberosweakencryption](/images/threatprevention/8.1/admin/analytics/kerberosweakencryption.webp) + +You can filter the data grid according to the Event Tracker status: All, New, or Reviewed. See the +[Event Tracker Window](/docs/threatprevention/8.1/admin/policies/configuration/recentevents/eventtracker.md) topic for additional information. + +The top data grid includes the following information for each incident: + +- From Host – Name of the originating host +- From Host IP Address – IP address of the originating host +- To Host – Name of the target host +- To Host IP Address – IP address of the target host +- Account Name – Security principal of the account that triggered the incident +- Account SID – Security Identifier of the account used in the event +- Access Type – Type of authentication with encryption, e.g. TGS: cifs/ enc:23/18, TGS: krbtgt/ enc: + 23/18, etc. +- SPN – The service principal name (SPN) included in the Kerberos ticket data +- Status – Indication of whether the authentication was successful +- Date/Time – Date timestamp of the monitored event. Hover over the data in this column to view the + local time (of the Enterprise Manager) and UTC time simultaneously. +- Detected on DC – Fully-qualified name of the domain controller that detected the event +- Encryption Type – Type of encryption identified as weak that triggered the incident +- Agent Time Logged – Timestamp for when the Agent detected the event. This can be different from + the Enterprise Manager time (displayed in the Date/Time column) due to latency. + +This data grid employs features for sorting, filtering, searching, and more. See the +[ Data Grid Functionality](/docs/threatprevention/8.1/admin/navigation/datagrid.md) topic for additional information. diff --git a/docs/threatprevention/8.1/admin/analytics/overview.md b/docs/threatprevention/8.1/admin/analytics/overview.md new file mode 100644 index 0000000000..82707ece24 --- /dev/null +++ b/docs/threatprevention/8.1/admin/analytics/overview.md @@ -0,0 +1,89 @@ +--- +title: "Analytics Interface" +description: "Analytics Interface" +sidebar_position: 70 +--- + +# Analytics Interface + +Analytics let organizations capture and analyze authentication traffic occurring within their Active +Directory environments in real time to detect patterns of behavior and scenarios relating to attacks +and attempts to compromise security. + +An Analytic is a hard-coded policy that reports on incidents triggered by events, rather than on the +individual events themselves. + +After you configure and enable an Analytic, the Agent begins monitoring for events. The Agent stores +each event in memory until events reach the trigger threshold. It then logs an incident in the +database along with the event details that triggered the incident. The Agent discards events that +don't trigger an incident from memory after the corresponding time range. + +The following tables outline the authentication analytics Threat Prevention provides by default, +along with definitions and examples to better understand each analytic. + +Click **Analytics** in the left pane to launch the Analytics interface. + +![Analytics interface](/images/threatprevention/8.1/admin/analytics/analyticsinterface.webp) + +At the top of the interface is a graphical display of the incidents Threat Prevention monitors. Use +the color key on the left to toggle off and on results for desired analytics. In the upper-right +corner, set the number of days’ worth of incidents the graphs display. Use the Refresh button in the +graphics area to regenerate the graphs. + +There are two graphs: + +- Pie graph – Shows the percentage of incidents generated for each analytic type +- Line graph – Shows a timeline of incidents for each analytic type + +The middle of the interface lists the analytic types, the number of attacks identified in the last +24 hours per type, controls to enable or disable monitoring, access to the analytic configuration, +and a tool tip with a brief summary of the analytic. + +:::info +For most analytics, configure at least one filter before enabling an analytic +type. +::: + + +The Refresh button on the Analytics ribbon repopulates both the graphical display and the analytic +list. + +Use the Permissions section at the bottom of the interface to protect Analytic policies at +the Analytics node. After you assign permission to a user, Threat Prevention protects all analytic +policies, configurations, and data from any user not included in the permissions list. See the +[Protect Policies](/docs/threatprevention/8.1/admin/policies/dataprotection.md#protect-policies) topic for instructions on how to +protect analytic policies. + +![Analytics node](/images/threatprevention/8.1/admin/analytics/analyticslist.webp) + +Directly under the Analytics node are the individual analytics nodes for accessing information on +the monitored incidents and configuring the analytic type: + +- [Brute Force Attacks Analytic Type](/docs/threatprevention/8.1/admin/analytics/bruteforceattacks.md) – Reports on failed attempts from a + single host to access a given host. Different user accounts with bad passwords or invalid account + names can trigger it. +- [User Account Hacking Analytic Type](/docs/threatprevention/8.1/admin/analytics/useraccounthacking.md) – Reports on multiple bad passwords + provided for a given valid user account +- [Horizontal Movement Attacks Analytic Type](/docs/threatprevention/8.1/admin/analytics/horizontalmovementattacks.md) – Reports on security + principals that are accessing more than the threshold of resources during a specified time + interval. This may indicate a person trying to obtain information from as many servers as + possible, which they normally wouldn't access. +- [Bad User ID (by User) Analytic Type](/docs/threatprevention/8.1/admin/analytics/baduseriduser.md) – Reports on pre-authentication failures + due to using account names that don't exist in Active Directory. Threat Prevention groups these + incidents per account name. +- [Bad User ID (by Source Host) Analytic Type](/docs/threatprevention/8.1/admin/analytics/baduseridsourcehost.md) – Reports on + pre-authentication failures due to using account names that don't exist in Active Directory. + Threat Prevention groups these incidents per source host. +- [Breached Password Analytic Type](/docs/threatprevention/8.1/admin/analytics/breachedpassword.md) – Reports on multiple failed + authentications followed by a successful authentication in a specified time frame +- [Concurrent Logins Analytic Type](/docs/threatprevention/8.1/admin/analytics/concurrentlogins.md) – Reports on logins from multiple locations + within a specified time frame +- [Impersonation Logins Analytic Type](/docs/threatprevention/8.1/admin/analytics/impersonationlogins.md) – Reports on multiple authenticated + accounts from a single system within a specified time frame +- [Golden Ticket Analytic Type](/docs/threatprevention/8.1/admin/analytics/goldenticket.md) – Reports on Kerberos tickets that exceed the + specified maximum lifetimes for a user ticket or maximum lifetimes for a user ticket renewal +- [File System Attacks (by User) Analytic Type](/docs/threatprevention/8.1/admin/analytics/filesystemattacksuser.md) – Reports on a significant + number of file changes made by an account in a short time period +- [Kerberos Weak Encryption Analytic Type](/docs/threatprevention/8.1/admin/analytics/kerberosweakencryption.md) – Reports on Kerberos tickets + with RC4_HMAC_MD5 encryption +- [Forged PAC Analytic Type](/docs/threatprevention/8.1/admin/analytics/forgedpac.md) – Reports on Kerberos tickets with modified PAC diff --git a/docs/threatprevention/8.1/admin/analytics/useraccounthacking.md b/docs/threatprevention/8.1/admin/analytics/useraccounthacking.md new file mode 100644 index 0000000000..325067ff33 --- /dev/null +++ b/docs/threatprevention/8.1/admin/analytics/useraccounthacking.md @@ -0,0 +1,166 @@ +--- +title: "User Account Hacking" +description: "User Account Hacking Analytic Type" +sidebar_position: 120 +--- + +# User Account Hacking Analytic Type + +The **User Account Hacking** analytic type identifies multiple bad passwords provided for a given +valid user account in the specified time interval. + +:::info +Configure a subset of accounts to monitor to avoid the excessive +volume of event activity that monitoring all accounts generates. +::: + + +| User Account Hacking | | +| -------------------- | ------------------------------- | +| Definition | Repeated failed logins below lockout thresholds and/or over extended periods | +| Example | Malware or a bad actor on the network is attempting to compromise an account by guessing the account’s password repeatedly until access is granted. To circumvent built-in lockout policies in Active Directory, the malware or bad actor will only guess so many times before backing off, making sure not to lockout the account. After a period of time has expired, it will continue its routine until the password is guessed correctly. This type of attack is easily automated using a script. The quiet nature of this type of attack often results in the attack going undetected.
\*The Enterprise Admin account (SID ending in -500) in Active Directory can't be locked out making it vulnerable to hacking and eventual breach. While Active Directory will show the account is locked out on the object itself, as soon as the correct password is supplied, the account will be automatically unlocked, giving the perpetrator “God-rights” to the enterprise. | +| Trigger | (X1 failed login attempts from an individual user account in Y1 minutes) OR (X2 failed login attempts from an individual user account in Y3 minutes) OR … | +| Recommended Settings | Set the number of attempts 1 or 2 increments below the organization’s Active Directory lockout policy settings. | + +**Analytic Workflow** + +1. Configure the analytic policy +2. Enable the analytic policy +3. Enable alerting on incidents through the + [System Alerting Window](/docs/threatprevention/8.1/admin/configuration/systemalerting/overview.md). + +See the User Account Hacking Analytic Data Grid topic for information on event data collected per +incident. + +## Configure User Account Hacking Analytic Policy + +Open the User Account Hacking Analytic Policy in any of the following ways: + +- Click Analytics in the left pane to launch the Analytics interface. Then click the gear icon for + the analytic. +- Expand the Analytics node and click the analytic you want. On the analytic window, click the gear + icon available in the top right corner. + +The Configure Analytics window has two tabs: + +- Settings – Where you define the analytic trigger +- Policy – Where you add filters, configure additional actions, set a custom schedule, and enable + the policy + +**Settings Tab** + +![User Account Hacking Analytic Type - Settings tab](/images/threatprevention/8.1/admin/analytics/accounthackingsettings.webp) + +Set the Number of Failed Logins and the Interval Duration to trigger the incident. The interval +duration uses (hours:minutes) and is capped at 23:59. When the specified number of failed +logins have occurred for an individual user account within the specified interval duration, Threat +Prevention triggers an incident record. + +By default, Threat Prevention caches authentication event data in memory for 24 hours. When an +incident triggers, Threat Prevention saves an incident record to the database along with the events +that triggered the incident. It purges raw authentication event data that didn't contribute to an +incident from memory once that data is more than 24 hours old. + +- Click the **Add** **(+)** button to include additional trigger conditions. Meeting any of the + specified conditions triggers an incident. For example, you can set one trigger condition to + generate an incident if there are _5 Failed Logins_ during an interval of _1 minutes_, + and another trigger condition to generate an incident if there are _10 Failed Logins_ + during an interval of _30 minutes_. Meeting either condition triggers an incident. +- Use the **Remove** **(x)** button to remove trigger conditions. + +The **Configure Accounts** link redirects you to the **Policy** > **Event Type** > **AD +Perpetrator** filter. + +If checked, the **Ignore failed logins for unresolved user names** option excludes bad user IDs +from contributing to User Account Hacking incidents. + +**Policy Tab** + +![User Account Hacking Analytic Type - Policy tab](/images/threatprevention/8.1/admin/analytics/policytab.webp) + +The **Policy** tab for configuring analytics consists of three sub-tabs: + +- General tab – Configured the same way a regular policy’s [General Tab](/docs/threatprevention/8.1/admin/policies/configuration/general.md) is + configured. The only exception is that the Name and Description are hard coded, and can't be + modified. The Tags field is disabled for analytics. +- Event Type tab – Configured the same way a regular policy’s + [Event Type Tab](/docs/threatprevention/8.1/admin/policies/configuration/eventtype/overview.md) is configured. The only exception is that the + [Authentication Monitoring Event Type](/docs/threatprevention/8.1/admin/policies/configuration/eventtype/authenticationmonitoring.md) is hard + coded, and the Success filter can't be modified. + + - Scope the accounts to include in or exclude from monitoring on the AD Perpetrator filter. + - _Optional_: Scope the protocol to monitor on the Authentication Protocol filter. If you + enable the analytic on a domain controller, also scope the login type. + + :::note + The Exclude failed authentications with ‘N-2’ passwords option requires a GPO + within the organization configured to ‘Enforce password history’ with a setting of a + minimum of ‘3 passwords remembered’. Otherwise, the option has no effect. + ::: + + + - _Optional_: Scope the domains to include in or exclude from monitoring on the + Domains/Servers filter. + - _Optional_: Scope the servers to include in or exclude from monitoring on the IP + Addresses (from) filter, the IP Addresses (to) filter, the Hosts (from) filter, or the Hosts + (to) filter. + + :::note + Some authentication events may return only a host name (NetBIOS or FQDN), others + may return only an IP address. Take this into account when entering + filter values. + ::: + + +- Actions tab – Configured the same way a regular policy’s + [Actions Tab](/docs/threatprevention/8.1/admin/policies/configuration/actions/overview.md) is configured. The only exceptions are that the + “Send to Event DB” and “Email Notifications” options are disabled. Analytic policies store the + event data they collect in memory until an incident triggers. Use _caution_ with the “Send Raw + Data to SIEM” option, as it sends all event data rather than the triggered incident, which + could be a large volume of data. To send notifications on incidents, use the + [System Alerting Window](/docs/threatprevention/8.1/admin/configuration/systemalerting/overview.md) to configure Email and SIEM + alerts. + +## User Account Hacking Analytic Data Grid + +The data grid on the **User Account Hacking** node lists one row per incident identified. + +![User Account Hacking Analytic Type window](/images/threatprevention/8.1/admin/analytics/useraccounthacking.webp) + +You can filter the data grid according to the Event Tracker status: All, New, or Reviewed. See the +[Event Tracker Window](/docs/threatprevention/8.1/admin/policies/configuration/recentevents/eventtracker.md) topic for additional information. + +The top data grid includes the following information for each incident: + +- Attacked Account Name – Security principal of the account that triggered the incident + + :::note + The name displays in red if the attacking account is the Administrator account. + ::: + + +- Attacked Account SID – Security Identifier of the account used in the event +- First Attempt – Date timestamp of the first monitored event that triggered the incident. Hover + over the data in this column to view the local time (of the Enterprise Manager) and UTC time + simultaneously. +- Last Attempt – Date timestamp of the last event that triggered the incident. Hover over the data + in this column to view the local time (of the Enterprise Manager) and UTC time simultaneously. +- Number of Attempts – Number of attempts monitored during the specified interval matching this rule + +Select an incident in the top data grid to view information on the events that triggered the +incident: + +- From Host – Name of the originating host +- From Host IP Address – IP address of the originating host +- Protocol – Protocols used for the monitored operation +- Access Type – Type of authentication, e.g. RDP, CIFS, etc. +- Status – Detailed information on the error generated by the event +- Detected on DC – Fully-qualified name of the domain controller that detected the event +- Events Count – Number of identical events that occurred in one minute +- Date/Time – Date timestamp of the monitored event. Hover over the data in this column to view the + local time (of the Enterprise Manager) and UTC time simultaneously. +- Agent Time Logged – Timestamp for when the Agent detected the event. This can be different from + the Enterprise Manager time (displayed in the Date/Time column) due to latency. + +This data grid employs features for sorting, filtering, searching, and more. See the +[ Data Grid Functionality](/docs/threatprevention/8.1/admin/navigation/datagrid.md) topic for additional information. diff --git a/docs/threatprevention/8.1/admin/configuration/_category_.json b/docs/threatprevention/8.1/admin/configuration/_category_.json new file mode 100644 index 0000000000..edfc42f1fc --- /dev/null +++ b/docs/threatprevention/8.1/admin/configuration/_category_.json @@ -0,0 +1,6 @@ +{ + "label": "Configuration", + "position": 30, + "collapsed": true, + "collapsible": true +} \ No newline at end of file diff --git a/docs/threatprevention/8.1/admin/configuration/accessanalyzerconfiguration.md b/docs/threatprevention/8.1/admin/configuration/accessanalyzerconfiguration.md new file mode 100644 index 0000000000..9907c99290 --- /dev/null +++ b/docs/threatprevention/8.1/admin/configuration/accessanalyzerconfiguration.md @@ -0,0 +1,52 @@ +--- +title: "Send Active Directory Event Data from Netwrix Threat Prevention to Netwrix Access Analyzer" +description: "Send Active Directory Event Data from Netwrix Threat Prevention to Netwrix Access Analyzer" +sidebar_position: 90 +--- + +# Send Active Directory Event Data from Netwrix Threat Prevention to Netwrix Access Analyzer + +When you configure Netwrix Threat Prevention to monitor a domain, you can provide the event data the +policies collect to Netwrix Access Analyzer (formerly Enterprise Auditor) for auditing and +analysis. To do this, configure Threat Prevention to send data to Netwrix Activity +Monitor, which in turn creates the activity log files that Access Analyzer collects. + +:::note +You can configure Threat Prevention to send event data to only one Netwrix application, +either Netwrix Activity Monitor or Netwrix Threat Manager, but not both. However, you can configure +the Activity Monitor with outputs for Access Analyzer and Threat Manager. +::: + + +To configure this integration: + +:::info +As a best practice, use the API Server option of the Activity Monitor for +this integration between Threat Prevention and Access Analyzer. +::: + + +**Step 1 –** In the Threat Prevention Administration Console, click **Configuration** > **Netwrix +Threat Manager Configuration** on the menu. The Netwrix Threat Manager Configuration window opens. + +**Step 2 –** On the Event Sink tab, configure the following: + +- Netwrix Threat Manager URI – Enter the name of the Activity Monitor agent host and port, which is + 4499 by default, in the following format: + + `amqp://localhost:4499` + + You must use localhost, even if Activity Monitor and Threat Prevention are installed on + different servers. + +- App Token – Leave this field blank for integration with Activity Monitor +- Policies – The table displays all policies created in Threat Prevention along with a State icon + indicating if the policy is active. Check the **Send** box for the policies you want that monitor + the target domain activity. + +**Step 3 –** Click **Save**. + +Threat Prevention now sends all real-time event data from the selected policies to Activity Monitor. +You can add more policies to this data stream through the Netwrix Threat Manager Configuration +window or by selecting the **Send to Netwrix Threat Manager** option on the Actions tab of the +respective policy. diff --git a/docs/threatprevention/8.1/admin/configuration/collectionmanager/_category_.json b/docs/threatprevention/8.1/admin/configuration/collectionmanager/_category_.json new file mode 100644 index 0000000000..d6eb3d18d8 --- /dev/null +++ b/docs/threatprevention/8.1/admin/configuration/collectionmanager/_category_.json @@ -0,0 +1,10 @@ +{ + "label": "Collection Manager Window", + "position": 10, + "collapsed": true, + "collapsible": true, + "link": { + "type": "doc", + "id": "overview" + } +} \ No newline at end of file diff --git a/docs/threatprevention/8.1/admin/configuration/collectionmanager/dynamic.md b/docs/threatprevention/8.1/admin/configuration/collectionmanager/dynamic.md new file mode 100644 index 0000000000..89f358b7bc --- /dev/null +++ b/docs/threatprevention/8.1/admin/configuration/collectionmanager/dynamic.md @@ -0,0 +1,201 @@ +--- +title: "Dynamic Collections" +description: "Dynamic Collections" +sidebar_position: 20 +--- + +# Dynamic Collections + +Certain options in the upper-left corner of the +[Add New Collection Window](/docs/threatprevention/8.1/admin/configuration/collectionmanager/listcollections.md#add-new-collection-window) are only enabled for the +following collection categories: + +- Domains & Servers – Dynamic Domains & Servers Collection Table Requirements +- Objects – Dynamic Objects Collection Table Requirements +- Perpetrators and Lockdown Perpetrators – Dynamic Perpetrators Collections Table Requirements +- IP Addresses – Dynamic IP Addresses Collection Table Requirements +- Hosts – Dynamic Hosts Collection Table Requirements +- File Paths – Dynamic File Paths Collection Table Requirements + +![Options on the Add New Collection window](/images/threatprevention/8.1/admin/configuration/collectionmanager/addcollectionoptions.webp) + +- The _I will provide a list_ option button enables the default setting for a static collection. See + the [Add New Collection Window](/docs/threatprevention/8.1/admin/configuration/collectionmanager/listcollections.md#add-new-collection-window) topic to manually + add a new collection. +- The _I want a list to come from the database table_ option button enables a dynamic collection. + Enter the table name in the textbox that appears or select it from the dropdown menu. + +You can populate the dynamic collection tables manually or with a third-party product, as long as +they meet the table requirements for the intended collection category. + +Any policy assigned a dynamic collection uses the current table’s data for the policy +filter, resulting in a dynamic policy. + +An active policy recognizes any changes to the selected table’s data when the Agent +communicates with the Threat Prevention Enterprise Manager. This may result in a maximum delay of +five minutes between a change in the table and the Agent refresh. + +## Dynamic Domains & Servers Collection Table Requirements + +When you use a dynamic Domains & Servers collection, the referenced table must meet the +following requirements: + +- Table Location – Must be in the NVMonitorConfig database +- Table Naming Convention – Must have a prefix of ‘dc*domain_server*’ +- Table Schema – Must have the following column: + +| Column Name | Column Type | Column Description | +| ---------------- | --------------- | --------------------------------------------- | +| DomainServerName | NVARCHAR (1024) | Name of the domain or server. Can't be null. | + +Example table entry for domain: + +**ExampleDomain** + +Example table entry for server: + +**ExampleServer** + +:::note +Threat Prevention creates an empty table with the required prefix and schema if the [Table +name] entered doesn't exist in the NVMonitorConfig database. +::: + + +## Dynamic Objects Collection Table Requirements + +When you use a dynamic Object collection, the referenced table must meet the following +requirements: + +- Table Location – Must be in the NVMonitorConfig database +- Table Naming Convention – Must have a prefix of ‘dc*ad_objects*’ +- Table Schema – Must have the following column: + +| Column Name | Column Type | Column Description | +| ----------- | --------------- | ---------------- | +| AdObject | NVARCHAR (1024) | Distinguished name of the Active Directory object. Can't be null. | + +Example table entry: + +**CN=User,DC=Domain,DC=Local** + +:::note +Threat Prevention creates an empty table with the required prefix and schema if the [Table +name] entered doesn't exist in the NVMonitorConfig database. +::: + + +## Dynamic Perpetrators Collections Table Requirements + +When you use a dynamic Perpetrators or Lockdown Perpetrators collection, the referenced table +must meet the following requirements: + +- Table Location – Must be in the NVMonitorConfig database +- Table Naming Convention – Must have a prefix of ‘dc*perpetrators*’ +- Table Schema – Must have the following columns: + +| Column Name | Column Type | Column Description | +| -------------- | --------------- | --------------------- | +| AccountName | NVARCHAR (1024) | Distinguished name of the account. Can't be null. | +| AccountSid | NVARCHAR (184) | SDDL form of the account Security ID. Can't be null. | +| AccountType | INT | Account type using the following values:
  • 0 = none
  • 1 = user
  • 2 = group
  • 3 = context
  • 4 = orgRole
  • 5 = sidtype
  • 6 = other
  • 7 = dynamic
  • 8 = dynamic_group
Can't be null. | +| IncludeSubtree | INT | Indicates whether to include child containers:
  • 0 = Child containers NOT included
  • 1 = Child containers included
Can't be null. | + +Example table entry: + +**CN=User,DC=Domain,DC=Local | S-1-5-21-1004336348-1177238915-682003330-500 | 3 | 0** + +:::note +Threat Prevention creates an empty table with the required prefix and schema if the [Table +name] entered doesn't exist in the NVMonitorConfig database. +::: + + +## Dynamic IP Addresses Collection Table Requirements + +When you use a dynamic IP Addresses collection, the referenced table must meet the following +requirements: + +- Table Location – Must be in the NVMonitorConfig database +- Table Naming Convention – Must have a prefix of 'dc*ip_addresses*' +- Table Schema – Must have the following column: + +| Column Name | Column Type | Column Description | +| ----------- | --------------- | ------------------------------------ | +| IpAddress | NVARCHAR (1024) | Address of the host. Can't be null. | + +Example table entry: + +192.168.1.3 + +:::note +Threat Prevention creates an empty table with the required prefix and schema if the [Table +name] entered doesn't exist in the NVMonitorConfig database. +::: + + +## Dynamic Hosts Collection Table Requirements + +When you use a dynamic Hosts collection, the referenced table must meet the following +requirements: + +- Table Location – Must be in the NVMonitorConfig database +- Table Naming Convention – Must have a prefix of ‘dc*hosts*’ +- Table Schema – Must have the following columns: + +| Column Name | Column Type | Column Description | +| --------------- | --------------- | ----------------------------------------- | +| NetbiosHostName | NVARCHAR (1024) | Name of the host | +| DnsHostName | NVARCHAR (1024) | Domain Name System (DNS) name of the host | +| IpAddress | NVARCHAR (1024) | IP v4 Address of the host | +| IpV6Address | NVARCHAR (1024) | IP v6 Address of the host | + +\*\*At least one column can't be null. + +Example table entry with all fields populated: + +**host | host.dc.com | 10.0.10.19 | fe80::4d72:80e9:72cf:425f%10** + +Example table entry tjat excludes IP v6 Address: + +**host | host.dc.com | 10.0.10.19 | [null]** + +Example table entry that excludes IP v4 Address: + +**host | host.dc.com | [null]  | fe80::4d72:80e9:72cf:425f%10** + +:::note +Threat Prevention creates an empty table with the required prefix and schema if the [Table +name] entered doesn't exist in the NVMonitorConfig database. +::: + + +## Dynamic File Paths Collection Table Requirements + +When you use a dynamic File Paths collection, the referenced table must meet the following +requirements: + +- Table Location – Must be in the NVMonitorConfig database +- Table Naming Convention – Must have a prefix of 'dc*file_path*' +- Table Schema – Must have the following columns: + +| Column Name | Column Type | Column Description | +| -------------- | --------------- | --------------------- | +| Path | NVARCHAR (1024) | File path to the target folder. Can't be null. | +| IncludeSubtree | INT | Indicates whether Threat Prevention processes subfolders:
  • 0 = Not Included
  • 1 = Included
| +| TargetAgent | NVARCHAR (1024) | Agent that monitors the target server. Can't be null. | + +Example table entry: + +**c:\Windows | 0 | ExampleFSserver** + +:::note +Threat Prevention creates an empty table with the required prefix and schema if the [Table +name] entered doesn't exist in the NVMonitorConfig database. +::: + + +The installation/upgrade process creates two tables for the File Path collections: + +- Folders with Sensitive Data Collection – dc_file_path_SensitiveDataFolders table +- Open Shares Collection – dc_file_path_OpenShares table diff --git a/docs/threatprevention/8.1/admin/configuration/collectionmanager/listcollections.md b/docs/threatprevention/8.1/admin/configuration/collectionmanager/listcollections.md new file mode 100644 index 0000000000..1d076a384d --- /dev/null +++ b/docs/threatprevention/8.1/admin/configuration/collectionmanager/listcollections.md @@ -0,0 +1,143 @@ +--- +title: "List of Collections Window" +description: "List of Collections Window" +sidebar_position: 10 +--- + +# List of Collections Window + +Use the List of Collections window to add new items to a collection as well as edit and remove +existing items. + +Click **Configuration** > **Collections** on the menu to launch the +[Collection Manager Window](/docs/threatprevention/8.1/admin/configuration/collectionmanager/overview.md). Then either double-click a Collection or select a +Collection and click the Manage button to open the List of Collections window. + +![List of Collections window](/images/threatprevention/8.1/admin/configuration/collectionmanager/listofcollections.webp) + +The Collection Category displays at the top of the window. Each item in the list displays: + +- Name – Name of the collection +- Item Count – Number of items in the collection +- Dependency Count – Number of policies or policy templates referencing the collection + +Use the Add, Edit, Remove, Dependencies, and Export buttons to modify a collection. + +## Add New Collection Window + +To add a static collection: + +**Step 1 –** Click **Add** on the List of Collections window to open the Add New Collection window. + +![Add New Collections window](/images/threatprevention/8.1/admin/configuration/collectionmanager/addnewcollection.webp) + +**Step 2 –** Select an option: + +- The _I will provide a list_ option button enables the default setting for a static collection. +- The _I want a list to come from the database table_ option button enables a dynamic collection. + Enter the table name in the textbox that appears or select it from the dropdown menu. See the + [Dynamic Collections](/docs/threatprevention/8.1/admin/configuration/collectionmanager/dynamic.md) topic for additional information. + +**Step 3 –** Provide a unique, descriptive name for the collection in the name box. + +**Step 4 –** Provide a detailed description in the Description box. + +**Step 5 –** Threat Prevention automatically populates the Created By, Created On, Modified By, and +Modified On boxes when you create or change collections. + +**Step 6 –** Use the Add (+) button to search for Items that match the selected Collection category. + +The Select… window opens. Select a server/Agent from the dropdown menu and click **Connect**. +Expand the domain tree in the navigation pane. Select an item in the Results pane on the right and +click **OK**. See the [Selection Windows](/docs/threatprevention/8.1/admin/policies/configuration/eventtype/window/overview.md) topic for +additional information. + +![Select window](/images/threatprevention/8.1/admin/configuration/collectionmanager/selectadobjects.webp) + +Use the **Remove** (x) button to remove Items from the list on the Add New Collection window. + +You can configure some collections as dynamic collections. See the +[Dynamic Collections](/docs/threatprevention/8.1/admin/configuration/collectionmanager/dynamic.md) topic for additional information. The Perpetrators and Lockdown +Perpetrators collections also have the option to expand group membership. See the Expand Groups +Option for Perpetrators & Objects Collection topic for additional information. + +**Step 7 –** When the configuration is set, click **OK** to save the collection. + +## Expand Groups Option for Perpetrators & Objects Collection + +The Expand Groups option on the Add New Collection window is only available for the following +collections: + +- Perpetrators +- Lockdown Perpetrators +- Objects +- Lockdown Objects + +![Expand Groups option on the Add New Collection window](/images/threatprevention/8.1/admin/configuration/collectionmanager/expandgroups.webp) + +- For Perpetrators – If checked, Threat Prevention expands the groups and nested groups to monitor + effective group membership at the user level. This means the Agent monitors/blocks based on the + user’s token rather than the group’s token. For Lockdown Perpetrators collections specifically, + this option immediately blocks a logged-in user whose group membership changed while they were + logged in. +- For Objects – If checked, when you add a group object, Threat Prevention expands the groups and + nested groups to monitor effective group membership at the user level. This means the Agent + monitors/blocks based on the user’s token rather than the group’s token. For Lockdown Objects + collections specifically, this option immediately blocks a logged-in user whose group membership + changed while they were logged in. + +The Expand Groups option **doesn't** apply to other object types. + +Threat Prevention can expand a maximum of 1000 users/objects. If the total number of users or +objects of the groups added to a single collection exceeds 1000, then the Agent defaults to +monitoring/blocking based on the groups’ tokens. + +If group membership can't be resolved, then the Agent defaults to monitoring/blocking based on the +groups’ tokens. + +## Edit Collection Window + +**Step 1 –** Select a collection on the List of Collections window and click **Edit**. The Edit +Collection window opens. + +![Edit Collection Window](/images/threatprevention/8.1/admin/configuration/collectionmanager/editcollection.webp) + +**Step 2 –** You can modify the name, description, and items in the collection. See the Add New +Collection Window topic for additional information on these settings. + +## Remove Collection + +**Step 1 –** Select a collection on the List of Collections window and click **Remove**. + +:::note +You can't delete a collection assigned to an active policy, as indicated in the +Dependency Count column. Remove the collection from all policies it's assigned to before +deleting it. +::: + + +![Confirm Removal window](/images/threatprevention/8.1/admin/configuration/collectionmanager/confirmremoval.webp) + +**Step 2 –** Click **Yes** on the Confirm Removal window to delete the collection. + +## Collection Dependencies Window + +**Step 1 –** Select a collection on the List of Collections window and click **Dependencies** to +open the Collection Dependencies window. + +![Collection Dependencies Window](/images/threatprevention/8.1/admin/configuration/collectionmanager/dependencies.webp) + +**Step 2 –** This window displays a list of all policy templates and policies the selected +collection is assigned to. View the list and click **OK**. + +## Export Collections + +You can select one or more collections on the List of Collections window and export their +information to a TSV file. + +To export a collection in the list: + +**Step 1 –** Select one or more collections on the List of Collections window and click **Export**. + +**Step 2 –** The Save As window opens. It displays the default file name and save location. Modify +them if required and click **Save**. diff --git a/docs/threatprevention/8.1/admin/configuration/collectionmanager/overview.md b/docs/threatprevention/8.1/admin/configuration/collectionmanager/overview.md new file mode 100644 index 0000000000..dc1eeea088 --- /dev/null +++ b/docs/threatprevention/8.1/admin/configuration/collectionmanager/overview.md @@ -0,0 +1,99 @@ +--- +title: "Collection Manager Window" +description: "Collection Manager Window" +sidebar_position: 10 +--- + +# Collection Manager Window + +Use the Collection Manager window to manage all Microsoft Collections. Click +**Configuration** > **Collections** on the menu to launch it. This window is only available to +Threat Prevention administrators. + +![Collection Manager Window](/images/threatprevention/8.1/admin/configuration/collectionmanager/collectionmanager.webp) + +Collections are reusable lists of policy filter settings that help streamline the task of +associating filters with event types on the Event Type tab during +[Policy Configuration](/docs/threatprevention/8.1/admin/policies/configuration/configuration.md) or +[Template Configuration](/docs/threatprevention/8.1/admin/templates/configuration/configuration.md). You configure them globally and can +use them in multiple policies in place of or in conjunction with individual filters. These +collections are empty until you populate them with your environment information. When you modify a +collection, the modifications affect all policies referencing the collection. You must deploy at +least one Agent to populate Collections. + +To use policy templates to create new policies, you must configure Collections. Several templates +use Collections as a policy filter. If the Collection is empty, the policy +doesn't monitor what it was designed to monitor. + +Collections are organized into the following categories for Microsoft Collections: + +- Domains & Servers – Any domain or server (by name) +- Contexts – Any context (e.g. containers and organizational units) within Active Directory +- Objects – Any Active Directory object +- Exchange Objects – Any mail-enabled user accounts or distribution lists +- Lockdown Objects – Any Active Directory object, used for lockdown purposes +- Exchange Trustees – Any account that has permission to another account’s mailbox or folder +- Perpetrators – Any security principal that is making a change, used for monitoring purposes +- Lockdown Perpetrators – Any security principal that is making a change, used for lockdown purposes +- Exchange Perpetrators – Any security principal that is making a change in an Exchange environment, + used for both monitoring and lockdown purposes +- Classes – Any class within Active Directory +- Attributes – Any attribute within Active Directory +- ADCS Attributes – Any certificate attribute within Active Directory Certificate Services +- IP Addresses – Any client address +- Hosts – Any computer (by NetBIOS, DNS, and IP address) +- File Paths – List of file paths for Windows file systems, for use with multiple agents + +Select a collection category and click **Manage…** i to open the +[List of Collections Window](/docs/threatprevention/8.1/admin/configuration/collectionmanager/listcollections.md). + +## Preconfigured Collections + +Threat Prevention has the following pre-configured Collections: + +| Collection Type | Name | +| --------------------- | --------------------------------------------------------- | +| Domains and Servers | SBServers | +| Objects | Administrator Accounts | +| Objects | Administrator Groups | +| Objects | Sensitive Groups | +| Objects | Service Accounts | +| Perpetrators | Administrative Accounts | +| Perpetrators | Domain Administrators | +| Perpetrators | Failed Authentications | +| Perpetrators | Service Accounts | +| Perpetrators | Successful Authentications | +| Perpetrators | Successful HIPPAA PHI Account Authentications | +| Perpetrators | System Accounts | +| Lockdown Perpetrators | Allow Perpetrators | +| Lockdown Perpetrators | Critical GPO - Allow Perpetrators | +| Lockdown Perpetrators | DNS Records - Allow Perpetrators | +| Lockdown Perpetrators | GPOs - Allow  Perpetrators | +| Lockdown Perpetrators | Group Lockdown - Allow Perpetrators | +| Lockdown Perpetrators | Group User OU Object Delete and Move - Allow Perpetrators | +| Lockdown Perpetrators | Object Permissions - Allow Perpetrators | +| Lockdown Perpetrators | OU Structure - Allow Perpetrators | +| Lockdown Perpetrators | Root Object - Allow Perpetrators | +| Lockdown Perpetrators | User Lockdown - Allow Perpetrators | +| Classes | Exclude Classes | +| Classes | Threat Manager - AD Excluded Classes | +| Attributes | Exclude Attributes | +| Attributes | Exclude User Attributes | +| Attributes | Property Set: DNS-Host-Name-Attributes | +| Attributes | Property Set: Domain-Other-Parameters | +| Attributes | Property Set: Domain-Password | +| Attributes | Property Set: General-Information | +| Attributes | Property Set: Membership | +| Attributes | Property Set: Personal-Information | +| Attributes | Property Set: Private-Information | +| Attributes | Property Set: Public-Information | +| Attributes | Property Set: RAS-Information | +| Attributes | Property Set: Terminal-Server-License-Server | +| Attributes | Property Set: User-Account-Restrictions | +| Attributes | Property Set: User-Login | +| Attributes | Property Set: Web-Information | +| Attributes | Threat Manager - AD Excluded Attributes | +| Hosts | Domain Controllers | +| Hosts | Exchanges Servers | +| File Paths | Folders with Sensitive Data. If you | +| File Paths | Open Shares | diff --git a/docs/threatprevention/8.1/admin/configuration/databasemaintenance/_category_.json b/docs/threatprevention/8.1/admin/configuration/databasemaintenance/_category_.json new file mode 100644 index 0000000000..edc3426e71 --- /dev/null +++ b/docs/threatprevention/8.1/admin/configuration/databasemaintenance/_category_.json @@ -0,0 +1,10 @@ +{ + "label": "Database Maintenance Window", + "position": 20, + "collapsed": true, + "collapsible": true, + "link": { + "type": "doc", + "id": "overview" + } +} \ No newline at end of file diff --git a/docs/threatprevention/8.1/admin/configuration/databasemaintenance/archive.md b/docs/threatprevention/8.1/admin/configuration/databasemaintenance/archive.md new file mode 100644 index 0000000000..0702ab7e4d --- /dev/null +++ b/docs/threatprevention/8.1/admin/configuration/databasemaintenance/archive.md @@ -0,0 +1,112 @@ +--- +title: "Archive Data" +description: "Archive Data" +sidebar_position: 20 +--- + +# Archive Data + +To use the Move operation on the [Database Maintenance Window](/docs/threatprevention/8.1/admin/configuration/databasemaintenance/overview.md), you must specify a +database where Threat Prevention archives data. You can also define settings to delete data aged +beyond a specified threshold from the archive database. + +:::info +Consider periodically retiring the current archive database and creating a new +one. Depending on the size of the archive database, it could be yearly or every few years. +::: + + +## Configure the Archive Database + +To configure settings for the archive database: + +**Step 1 –** Click **Configuration** > **Database** > **Maintenance** on the menu. The Database +Maintenance window opens. Click the **Archive DB** tab. + +![Database Maintenance window - Archive DB tab](/images/threatprevention/8.1/admin/configuration/databasemaintenance/archivedb.webp) + +**Step 2 –** Enter the following information for the database where Threat Prevention archives data: + +- Server – SQL Server where the archive database is located +- Port – Instance port number, by default this is set to 0 +- Database – Name of the archive database +- Authentication + - For Windows Authentication – Check the Use Windows Authentication box + - For SQL Authentication – Enter theuser name and password of an account to use for SQL + authentication + +**Step 3 –** Click **Save** to save the configurations. + +To query archived event data, use the Investigate interface. See the +[Investigate Interface](/docs/threatprevention/8.1/admin/investigate/overview.md) topic for additional information. + +## Enable Database Maintenance for the Archive Database + +You can specify settings to automatically delete archived data that has aged beyond a specified +threshold. You can set the threshold per Event Type, per Analytics, and/or per Policy. Although you +can enable all three options with different retention periods, the Event Type maintenance settings +take precedence over Policy maintenance settings where the selected policy employs that event type. + +The [Alerts Interface](/docs/threatprevention/8.1/admin/alerts/overview.md) displays alerts generated for the archive database +maintenance job with "Archive DB:" as a prefix in the Message column. +This helps you distinguish between alerts generated for database maintenance and archive database +maintenance. + +To enable database maintenance for the archive database: + +**Step 1 –** Click **Configuration** > **Database** > **Maintenance** on the menu. The Database +Maintenance window opens. Click the **Archive DB** tab. + +Ensure that you have configured the archive database settings and that the archiving process has run +at least once. + +**Step 2 –** Click the **Configure Archive DB Maintenance** button. The Archive DB Maintenance +window opens. + +![Archive DB Maintenance window](/images/threatprevention/8.1/admin/configuration/databasemaintenance/archivedbmaintenance.webp) + +The top of the window displays the following information: + +- Archive Database Information: + +> > - Server – SQL Server where Threat Prevention performs database maintenance +> > - Database – Name of the database +> > - Database Size – Current size of the database +> > - Oldest Data – Date of the oldest data in the database + +- Job Information: + - Last run – Date timestamp when the last database maintenance job ran + - Status – Status of the job. Different statuses are: + - Idle – Indicates that no database maintenance task is running + - Succeeded – Indicates that the most recent job finished without error + - Running – Indicates that a job is running + - Error – Indicates that the job started but terminated on an error + - Running Step – During job execution, this field populates with the current step + - Elapsed Time – Overall elapsed time of job execution + +The Refresh button in the upper-right corner refreshes this database and job information. + +**Step 3 –** From the Run SQL Agent job on dropdown menu, select an option to determine the SQL +Agent that runs the maintenance job. + +- Select **Main DB** if the archive database resides on the same SQL Server machine as the + NVMonitorData database. +- Select **Archive DB** if the archive database resides on a different SQL Server machine than the + NVMonitorData database. + +**Step 4 –** On the Event Type, Analytics, and/or Policy tabs, enable maintenance for all or some of +the options. See the [Enable Database Maintenance](/docs/threatprevention/8.1/admin/configuration/databasemaintenance/enable.md) topic for additional information. + +The [Event Type Tab](/docs/threatprevention/8.1/admin/configuration/databasemaintenance/overview.md#event-type-tab), [Analytics Tab](/docs/threatprevention/8.1/admin/configuration/databasemaintenance/overview.md#analytics-tab), and +[Policy Tab](/docs/threatprevention/8.1/admin/configuration/databasemaintenance/overview.md#policy-tab) on the Archive DB Maintenance window are the same as on the +Database Maintenance window, except that only the 'Delete' operation is available for the archive +database. + +**Step 5 –** On the Schedule tab, set the frequency and time when the database maintenance job runs. +See the [Schedule Database Maintenance](/docs/threatprevention/8.1/admin/configuration/databasemaintenance/schedule.md) topic for additional information. + +**Step 6 –** Click **OK** on the Archive DB Maintenance window. + +**Step 7 –** Click **Save** on the Database Maintenance window to save the changes. + +Database maintenance is now enabled for the archive database. diff --git a/docs/threatprevention/8.1/admin/configuration/databasemaintenance/enable.md b/docs/threatprevention/8.1/admin/configuration/databasemaintenance/enable.md new file mode 100644 index 0000000000..d12ce97232 --- /dev/null +++ b/docs/threatprevention/8.1/admin/configuration/databasemaintenance/enable.md @@ -0,0 +1,50 @@ +--- +title: "Enable Database Maintenance" +description: "Enable Database Maintenance" +sidebar_position: 10 +--- + +# Enable Database Maintenance + +You can enable database maintenance for all or specific event types, analytics, and/or policies, and +for any combination of event type data, analytic data, and policy data. + +:::tip +The Event Type maintenance settings take precedence over Policy maintenance settings +where the selected policy employs that event type. +::: + + +To enable database maintenance: + +**Step 1 –** Click **Configuration** > **Database** > **Maintenance** on the menu. The Database +Maintenance window opens. + +**Step 1 –** Select the tab you want (Event Type, Analytics, or Policy) and check the **Enabled** box +at the top of the tab. + +![Database Maintenance window - Event Type tab](/images/threatprevention/8.1/admin/configuration/databasemaintenance/enablesettings.webp) + +**Step 2 –** Select a maintenance task (Event Type, Analytic, or Policy). To set the same operation +and retention period for multiple tasks, use the **ctrl-left click** command. + +**Step 3 –** Select either **Move** or **Delete** from the Operation dropdown menu. + +- The Move operation requires you to configure the Archive DB tab. See the + [Archive Data](/docs/threatprevention/8.1/admin/configuration/databasemaintenance/archive.md) topic for additional information. + +**Step 4 –** Set the Retention Period value and unit (Day, Week, or Month). This value indicates the +age of the data to keep when the database maintenance job runs. Threat Prevention deletes or +moves/archives older data according to the selected Operation. + +**Step 5 –** Click **Set**. + +**Step 6 –** Check the **Enable** box to include the tasks in the next database maintenance job. +The job only includes event types, analytics, and/or policies with the Enabled checkbox selected. + +**Step 7 –** Click **Save**. + +The Operation and Retention Period columns of the table display the configured maintenance options. + +Disabling a previously enabled database maintenance task doesn't remove the configured settings; it +only prevents that task from running in the next database maintenance job. diff --git a/docs/threatprevention/8.1/admin/configuration/databasemaintenance/overview.md b/docs/threatprevention/8.1/admin/configuration/databasemaintenance/overview.md new file mode 100644 index 0000000000..9cd8fb487f --- /dev/null +++ b/docs/threatprevention/8.1/admin/configuration/databasemaintenance/overview.md @@ -0,0 +1,166 @@ +--- +title: "Database Maintenance Window" +description: "Database Maintenance Window" +sidebar_position: 20 +--- + +# Database Maintenance Window + +The database maintenance function grooms the NVMonitorData database to optimize performance. It +automatically deletes or archives data aged beyond a specified threshold. You can set the threshold +per Event Type, per Analytics, and/or per Policy. Although you can enable all three options with +different retention periods, the Event Type maintenance settings take precedence over Policy +maintenance settings where the selected policy employs that event type. + +If you choose to archive data rather than delete it, you must specify a database for data +archiving. For this database, you can also define settings to delete data aged beyond a specified +threshold. + +:::tip +See the Database Maintenance Permission details in the +[Database Maintenance Feature Requirements](/docs/threatprevention/8.1/requirements/sqlserver/dbmaintenance.md) topic. +::: + + +See the [Stored Procedures](/docs/threatprevention/8.1/admin/configuration/databasemaintenance/storedprocedures.md) topic for additional information on stored +procedures Threat Prevention uses on its SQL Server databases. + +To configure database maintenance: + +**Step 1 –** Click **Configuration** > **Database** > **Maintenance** on the menu. The Database +Maintenance window opens. + +This window is only available to Threat Prevention administrators. + +![Threat Prevention WinConsole Warning window](/images/threatprevention/8.1/admin/configuration/databasemaintenance/warning.webp) + +The database maintenance feature is only available if the SQL Server Agent service is running on the +SQL Server host. A warning message displays instead of the Database Maintenance window if this +service isn't running. + +To enable the service, go to **Start** > **Administrative Tools** > **Services** interface and start +the SQL Server Agent (MSSQLSERVER). + +When the SQL Server Agent service is running, the Database Maintenance window opens. + +![Database Maintenance window](/images/threatprevention/8.1/admin/configuration/databasemaintenance/databasemaintenance.webp) + +The top of the window displays the following information: + +- Database Information: + +> - Server – SQL Server where Threat Prevention performs database maintenance +> - Database – Name of the database +> - Database Size – Current size of the database +> - Oldest Data – Date of the oldest data in the database + +- Job Information: + - Last run – Date timestamp when the last database maintenance job ran + - Status – Status of the job. Different statuses are: + - Idle – Indicates that no database maintenance task is running + - Succeeded – Indicates that the most recent job finished without error + - Running – Indicates that a job is running + - Error – Indicates that the job started but terminated on an error + - Running Step – During job execution, this field populates with the current step + - Elapsed Time – Overall elapsed time of job execution + +The Refresh button in the upper-right corner refreshes this database and job information. + +**Step 2 –** On the Event Type, Analytics, and/or Policy tabs, enable maintenance for all or some of +the options. See the [Enable Database Maintenance](/docs/threatprevention/8.1/admin/configuration/databasemaintenance/enable.md) topic for additional information. + +**Step 3 –** On the Schedule tab, set the frequency and time when the database maintenance job runs. +See the [Schedule Database Maintenance](/docs/threatprevention/8.1/admin/configuration/databasemaintenance/schedule.md) topic for additional information. + +**Step 4 –** To use the Move operation, you must specify a database on the Archive DB tab. You can +also define settings to delete data aged beyond a specified threshold from the archive database. See +the [Archive Data](/docs/threatprevention/8.1/admin/configuration/databasemaintenance/archive.md) topic for additional information. + +**Step 5 –** Click **Save** to save the changes. + +:::info +Configure the SQL Server databases to use 'Simple Recovery Mode' as described in +the [SQL Server Requirements](/docs/threatprevention/8.1/requirements/sqlserver/sqlserver.md). This configuration has a direct +impact on the size of the transaction log during database maintenance delete tasks. If the databases +don't use Simple Recovery Mode, the transaction log may get quite large during +delete tasks. +::: + + +## Event Type Tab + +The Event Type tab displays by default when the Database Maintenance window opens. + +![Database Maintenance window - Event Type tab](/images/threatprevention/8.1/admin/configuration/databasemaintenance/eventtype.webp) + +Check the **Enabled** box at the top to set database maintenance by event type. The table contains +the following information: + +- Enable – Checked box indicates database maintenance is enabled for the event type +- Event Type – Threat Prevention groups data by the following event types: + - Active Directory – Configure maintenance for all event data collected by the Active Directory + Changes, Active Directory Lockdown, Active Directory Read Monitoring, AD Replication + Monitoring, AD Replication Lockdown, Effective Group Membership, FSMO Role Monitoring, GPO + Setting Lockdown, GPO Setting Changes, LSASS Guardian – Monitor, LSASS Guardian – Protect, and + Password Enforcement Event Types + - Authentications – Configure maintenance for all event data collected by the Authentication + Monitoring and Authentication Lockdown Event Types. This doesn't apply to Analytics policy + data + - Exchange – Configure maintenance for all event data collected by the Exchange Changes and + Exchange Lockdown Event Types + - File System – Configure maintenance for all event data collected by the File System Changes, + File System Lockdown, and File System Enterprise Auditor Event Types + - LDAP – Configure maintenance for all event data collected by the LDAP Monitoring, LDAP + Lockdown, and LDAP Bind Monitoring Event Types +- Operation – The operation set for the event type: Move (for archiving) or Delete +- Retention Period – The age of data to retain when the database maintenance job runs + for the event type + +## Analytics Tab + +Click the **Analytics** tab on the Database Maintenance window. + +![Database Maintenance window - Analytics tab](/images/threatprevention/8.1/admin/configuration/databasemaintenance/analytics.webp) + +Check the **Enabled** box at the top to set database maintenance by analytic. The table contains the +following information: + +- Enable – Checked box indicates database maintenance is enabled for the analytic +- Analytic Name – Name of each analytic +- Operation – The operation set for the analytic: Move (for archiving) or Delete +- Retention Period – The age of data to retain when the database maintenance job runs + for the analytic +- Incident Count – The number of incidents recorded in the database for each analytic +- Event Count – The number of events for the recorded incidents in the database for each analytic + +You can sort the rows in the table alphanumerically by the Analytic Name, Incident Count, or Event +Count column. + +Above the table is a cumulative count of: + +- Total Incidents – The number of incidents recorded in the database for all analytics +- Total Events – The number of events for the recorded incidents in the database for all analytics + +## Policy Tab + +Click the **Policy** tab on the Database Maintenance window. + +![Database Maintenance window - Policy tab](/images/threatprevention/8.1/admin/configuration/databasemaintenance/policy.webp) + +Check the **Enabled** box at the top to set database maintenance by policy. The table contains the +following information: + +- Enable – Checked box indicates database maintenance is enabled for the policy +- Policy – Name of each policy you created. The tab lists policies in alphanumeric order, showing + live policies (whether they are enabled) first and deleted policies last +- Operation – The operation set for the policy: Move (for archiving) or Delete +- Retention Period – The age of data to retain when the database maintenance job runs + for the policy +- Event Count – The number of events for the recorded incidents in the database for each policy + +Above the table is a cumulative count of: + +- Total Events – The number of events for the recorded incidents in the database for all policies + +You can sort the rows in the table alphanumerically by the Policy or Event Count column. Deleted +policies always appear after all other policies. diff --git a/docs/threatprevention/8.1/admin/configuration/databasemaintenance/schedule.md b/docs/threatprevention/8.1/admin/configuration/databasemaintenance/schedule.md new file mode 100644 index 0000000000..16df3a298b --- /dev/null +++ b/docs/threatprevention/8.1/admin/configuration/databasemaintenance/schedule.md @@ -0,0 +1,53 @@ +--- +title: "Schedule Database Maintenance" +description: "Schedule Database Maintenance" +sidebar_position: 30 +--- + +# Schedule Database Maintenance + +You must schedule the database maintenance job, which runs the specified operation on each of the +enabled event type data, analytic data, and/or policy data older than a specific period. You can run +this job once now, schedule it to run once at a later time, or schedule it to run +on a regular rotation. + +To configure a schedule: + +![Database Maintenance window - Schedule tab](/images/threatprevention/8.1/admin/configuration/databasemaintenance/schedule.webp) + +**Step 1 –** Click **Configuration** > **Database** > **Maintenance** on the menu. The Database +Maintenance window opens. + +**Step 1 –** Click the **Schedule** tab. + +**Step 1 –** Check the **Enabled** box. + +**Step 2 –** Select a frequency to run the database maintenance job: + +- One Time: Run now – Runs the database maintenance job once when you save the configurations on the + Database Maintenance window +- One Time: Run later – Runs the database maintenance job once according to the Start Date and Start + Time set +- Daily – Runs the database maintenance job once a day according to the Start Date and Start Time + set +- Weekly – Runs the database maintenance job once a week according to the Day Of Week, Start Date, + and Start Time set +- Monthly – Runs the database maintenance job once a month according to the Day of Month, Start + Date, and Start Time set + +**Step 3 –** Set the options under When for the selected frequency. + +- Start Date +- Start Time +- Day of Week (if applicable) +- Day of Month (if applicable) + +**Step 4 –** Click **Save** to save the settings. + +The database maintenance job now runs at the configured time and day. The job runs all tasks +enabled at the time it runs. + +You can view this scheduled job in Microsoft SQL Server Management Studio in the **SQL +Server Agent** > **Jobs** folder (SiDbMainJob). + +![Database Maintenance job in Microsoft SQL Server Management Studio](/images/threatprevention/8.1/admin/configuration/databasemaintenance/dbmaintenancejob.webp) diff --git a/docs/threatprevention/8.1/admin/configuration/databasemaintenance/storedprocedures.md b/docs/threatprevention/8.1/admin/configuration/databasemaintenance/storedprocedures.md new file mode 100644 index 0000000000..f57bc85943 --- /dev/null +++ b/docs/threatprevention/8.1/admin/configuration/databasemaintenance/storedprocedures.md @@ -0,0 +1,24 @@ +--- +title: "Stored Procedures" +description: "Stored Procedures" +sidebar_position: 40 +--- + +# Stored Procedures + +The table contains a list of the stored procedures Threat Prevention uses on its SQL Server +databases. See the [Database Maintenance Window](/docs/threatprevention/8.1/admin/configuration/databasemaintenance/overview.md) topic for additional information. + +| Name | When Threat Prevention Uses the Procedure | What the Stored Procedure Does | +| ------------------ | ---------------------- | ---------------- | +| DeleteAuthAnalytics | Called from the SQLAgent job if you select the “Delete” operation for database maintenance for Authentication Analytics. | This stored procedure deletes “old” data from the database in the following tables:
  • A_Login
  • A_Login2Policy
  • AR_BruteForceAttacks
  • AR_UserAccountHackingAttacks
  • AR_HorizontalMovementAttacks
  • AR_BadUserIdByUser
  • AR_BadUserIdByHost
  • AR_BreachedPassword
  • AR_ConcurrentLogins
  • AR_DiamondPAC
  • AR_EventTracker
  • AR_ImpersonationLogins
  • AR_GoldenTickets
  • AR_KerberosWeakEncryption
| +| DeleteByPolicy | Called from the SQLAgent job if you select the “Delete” operation for database maintenance for selected policies. | This stored procedure deletes “old” data from the database in the following tables:
  • NvEvent
  • NvEvent_EventTracker
  • AttributeValue
  • OldAttributeValue
  • EventPolicy
  • E_LDAP
  • E_LDAP_EventTracker
  • E_LDAP2Policy
| +| DeleteFSAnalytics | Called from the SQLAgent job if you select the “Delete” operation for database maintenance File System Analytics. | This stored procedure deletes “old” data from the database in the following tables:
  • A_FS
  • A_FS2Policy
  • AR_FilesPerUser
  • AR_EventTracker
| +| Delete LDAP | Called from the SQL Agent job if you select the “Delete” operation for database maintenance for the LDAP Event Type. | This stored procedure deletes “old” data from the database in the following tables:
  • E_LDAP
  • E_LDAP_EventTracker
  • E_LDAP2Policy
| +| DeleteNvEventByEventType | Called from the SQL Agent job if you select the “Delete” operation for database maintenance for all Event Types except LDAP. | This stored procedure deletes “old” data from the database in the following tables:
  • NvEvent
  • NvEvent_EventTracker
  • AttributeValue
  • OldAttributeValue
  • EventPolicy
| +| MoveAuthAnalytics | Called from the SQLAgent job if you select the “Move” operation for database maintenance for Authentication Analytics. | This stored procedure moves “old” data from one database to another in the following tables:
  • A_Login
  • A_Login2Policy
  • AR_BruteForceAttacks
  • AR_UserAccountHackingAttacks
  • AR_HorizontalMovementAttacks
  • AR_BadUserIdByUser
  • AR_BadUserIdByHost
  • AR_BreachedPassword
  • AR_ConcurrentLogins
  • AR_DiamondPAC
  • AR_EventTracker
  • AR_ImpersonationLogins
  • AR_GoldenTickets
  • AR_KerberosWeakEncryption
| +| MoveByPolicy | Called from the SQLAgent job if you select the “Move” operation for database maintenance for selected policies. | This stored procedure moves “old” database from one database to another in the following tables:
  • NvEvent
  • NvEvent_EventTracker
  • AttributeValue
  • OldAttributeValue
  • EventPolicy
  • E_LDAP
  • E_LDAP_EventTracker
  • E_LDAP2Policy
| +| MoveFSAnalytics | Called from the SQLAgent job if you select the “Move” operation for database maintenance for File System Analytics. | This stored procedure moves “old” data from one database into another in the following tables:
  • A_FS
  • A_FS2Policy
  • AR_FilesPerUser
  • AR_EventTracker
| +| Move LDAP | Called from the SQLAgent job if you select the “Move” operation for database maintenance for LDAP Event Type. | This stored procedure moves “old” data from one database into another in the following tables:
  • E_LDAP
  • E_LDAP_EventTracker
  • E_LDAP2Policy
| +| MoveNvEventsByEventType | Called from the SQLAgent job if you select the “Move” operation for database maintenance for all Event Types except LDAP. | This stored procedure moves “old” data from one database to another in the following tables:
  • NvEvent
  • NvEvent_EventTracker
  • AttributeValue
  • OldAttributeValue
  • EventPolicy
| +| RdbPolicyCopy | Called from the SQLAgent job if you select the “Move” operation for database maintenance. | This stored procedure creates a copy of the RdbPolicy table in the target database. | diff --git a/docs/threatprevention/8.1/admin/configuration/epesettings.md b/docs/threatprevention/8.1/admin/configuration/epesettings.md new file mode 100644 index 0000000000..5de3b5a8af --- /dev/null +++ b/docs/threatprevention/8.1/admin/configuration/epesettings.md @@ -0,0 +1,431 @@ +--- +title: "EPE Settings Window" +description: "EPE Settings Window" +sidebar_position: 30 +--- + +# EPE Settings Window + +You can configure Threat Prevention with Enterprise Password Enforcer (EPE) to use the Have I Been +Pwned (HIBP) database. The Netwrix website hosts a copy of this database. The HIBP database +contains a list of the hashes of known compromised passwords. During password change operations, you +can configure the application to reject passwords with a hash that matches a hash in the HIBP +database. The EPE Settings window displays current HIBP database information and configuration +options. + +You must first deploy the HIBP database to the Enterprise Manager. After Threat Prevention stores +the database, you can configure Threat Prevention Agents to obtain and use a local copy of the HIBP +database. To give Threat Prevention Agents a local copy of the database, enable the **Use Local +Pwned hash DB** setting in the Deploy Agents wizard's +[Set Options Window ](/docs/threatprevention/8.1/admin/agents/deploy/setoptions.md). + +Threat Prevention can authenticate password hashes against the stored HIBP database in the following +places across the environment: + +- Only the Enterprise Manager +- All or selected Threat Prevention Agents +- Mix of the Enterprise Manager and Threat Prevention Agents + +## Considerations When Deploying the HIBP Database + +Before deploying the HIBP database, consider the pros and cons when choosing its deployment +location. You can deploy it on the Threat Prevention Agent and/or the Enterprise Manager machine. + +:::tip +Both the Agent and the Enterprise Manager can be in one environment. +::: + + +If you copy and store the HIBP database on the Agent: + +- The HIBP database takes up additional space on the machine where you copy it (approximately 8 + GB, but subject to change) +- Checking passwords against the HIBP database doesn't require a network connection to the + application server +- The Agent checks the pending password candidate against the archived hash file locally and sends + the results to the Enterprise Manager. If a password hash matches, Threat Prevention rejects the + pending password change. +- The Enterprise Manager periodically compares its HIBP database version against the Agent's local + copy. If the Enterprise Manager has a newer copy, it updates the Agent copy. + +If you keep the HIBP database only on the Enterprise Manager: + +- The database takes up space only on the Enterprise Manager machine, not on the Agent machine +- Requires a working network connection from the Agent to the Enterprise Manager to check: + + - The pending password candidate from the Agent + - For and obtain updates to the HIBP database + +- The Agent sends the candidate hash value to the Enterprise Manager to compare against the + Enterprise Manager’s copy of the HIBP database + + - The advantage of this approach is that the domain controllers don't need space for the HIBP + database. The disadvantage is that at the time of a password change, if the Enterprise + Manager isn't available, the Agent must assume the hash is okay. + +## Configuration Settings + +Click **Configuration > EPE Settings** on the menu to open the EPE Settings window. + +:::note +The EPE Settings window is only available to Threat Prevention administrators. +::: + + +![EPE Settings window](/images/threatprevention/8.1/admin/configuration/epesettings.webp) + +The window displays current hash database information and has the following configuration settings, +displayed in sections on the window. + +### Current Hash DB Info + +Threat Prevention enables the Current hash DB Info area after you deploy the HIBP database to +Enterprise Manager for the first time. It displays the source you downloaded the database from, its size, +version, and the number of hashes it contains. It also shows a thumbprint value that changes +whenever the content of the Hash DB changes. + +:::tip +The publisher updates the HIBP dataset at random intervals. It can go weeks or +even months with no changes. +::: + + +### Check for Update Options + +The Check for Update options area specifies when Threat Prevention checks the Netwrix website for a +new version of the HIBP database. + +:::note +Threat Prevention enables these options after you deploy the HIBP database to Enterprise +Manager for the first time. +::: + + +Configure the following options: + +- Check update every [number] [unit of time] – Select how often Threat Prevention checks the Netwrix + website for a newer version of the HIBP database +- Start at [time] [day] – Select the time and day when Threat Prevention checks the Netwrix + website for a newer version of the HIBP database +- Check for new version – Checks the Netwrix website for the latest password hash file details and + compares the SHA-1 to the local hash file to determine if the website has a newer version of the + HIBP database. If you select only this option, Threat Prevention generates an alert in the + Administration Console when it detects a new version. + + :::note + This checkbox doesn't automatically download the new HIBP database version. + ::: + + +- Update pwned DB on new version – Checks the Netwrix website for HIBP updates and then updates the + Enterprise Manager server if it detects a new version + +After making selections, click the **Apply** button to enable checking for updates at the scheduled +intervals. + +### Passwords Hash Database + +Threat Prevention uses the Passwords Hash database to check if users’ new and pending password +(i.e. during a password reset) matches the hash of a compromised password from a data breach. + +:::note +First-time configuration of this window requires downloading the HIBP database from the +Netwrix website. If the Administration Console doesn't have internet access, see the Download and +Configure the Have I Been Pwned Hash List topic for instructions. +::: + + +:::warning +Ensure the initial update of the database occurs during non-office hours. Due to the +size of the hash file, this download takes up a significant amount of CPU and download time. +::: + + +- Passwords Hash Database Folder (path on Threat Prevention Server) – Central location of the Pwned + database on the application server. The default path is: + +**…\Netwrix\Netwrix Treat Prevention\SIEnterpriseManager\PwnedStore** + + + +- Location: + + - File – If the application server doesn't have internet access, you can manually download the + HIBP database and select the **File** radio button to browse to your local copy of the + database. + + Database Download link: + - [https://releases.netwrix.com/resources/stealthintercept/stealthintercept-hibp-database-2.0.0.zip](https://releases.netwrix.com/resources/stealthintercept/stealthintercept-hibp-database-2.0.0.zip) + + SHA-256 hash for the database: + - [https://releases.netwrix.com/resources/stealthintercept/stealthintercept-hibp-database-2.0.0.zip.sha256.txt](https://releases.netwrix.com/resources/stealthintercept/stealthintercept-hibp-database-2.0.0.zip.sha256.txt) + + - Website – This option points to the Netwrix website that hosts a copy of the latest HIBP + database. This is the default option and the preferred method if the application server has + internet access. + +- Apply: + + - If you select Website, clicking **Apply** downloads the HIBP database from the Netwrix + website and then processes the database for use by the application + - If you select File, clicking **Apply** processes the local copy of the (manually + obtained) database for use by the application + +### User Feedback Module + +The optional EPE User Feedback module (also known as the Credential Provider) provides feedback to +end users by listing the reasons the Enterprise Password Enforcement (EPE) event type has rejected a +candidate password. + +EPE offers multi-language support, ensuring users receive clear and consistent password rejection +messages. Supported languages are: + +- Chinese Simplified +- Chinese Traditional +- Czech +- Dutch +- English +- French +- German +- Hungarian +- Italian +- Japanese +- Korean +- Polish +- Portuguese +- Spanish +- Thai + +:::tip +You must deploy the module to end user computers. +::: + + +The User Feedback Module section has the following check boxes: + +- Enable EPE User Feedback Module – Select this checkbox to enable integration between an optional + EPE User Feedback module and the Threat Prevention Agent on a domain controller. Click **Update** + to apply the current state of the checkbox to the module. +- Use Custom Messages – Select this checkbox and click **Modify Messages** to open the Custom + Messages Editor window, where you can customize password rejection messages for the EPE User + Feedback module. + +![Custom Messages Editor window](/images/threatprevention/8.1/admin/configuration/custommessageseditor.webp) + +By default, messages are available in English. + +- Use the Language dropdown menu to select a language, The Default Message column displays messages + in English while you can edit the Custom Message column to provide the message in the selected + language. +- To edit, double-click a row in the Custom Message column and enter a message. Click **OK** to save + changes or **Cancel** to discard them. Select **Reset** to revert all customized messages back to + defaults. + +The string "{0}" is a placeholder that Threat Prevention populates at run time with the specific +values that led to the password rejection. Include "{0}" in all custom messages where you want to +display that run-time information. + +### Rules + +The following windows are global settings for the EPE Password Rules filter within the EPE Settings +window. Threat Prevention applies whatever you configure in these windows across all EPE Password +Rules filters in the Administration Console. + +![EPE Settings window - Rules area](/images/threatprevention/8.1/admin/configuration/rules.webp) + +You can monitor or block an event with these global settings: + +- Modify Password Dictionary – Requires an exact match between a user entered password and the + password in the dictionary +- Words List of – Global list of character substitutions found in passwords. Uses the Substitution + Editors map to check all permutations of a pending password. +- Substitutions Editor – Create a character substitution map used to create password permutations + for the Words List dictionary + +#### Password Dictionary Window + +The Password Dictionary window is a global setting used across all EPE policies. It contains a +centralized copy of the dictionary.dat file. This modifiable file contains all compromised +passwords. You can add, remove, and modify passwords in the list. + +:::tip +For Threat Prevention to reject a password, the user's pending password must exactly match a +password in the Password Dictionary list. +::: + + +Click the **Modify Passwords Dictionary** button in the Rules area on the EPE Settings window. The +Password Dictionary window opens. + +![Password Dictionary window](/images/threatprevention/8.1/admin/configuration/passworddictionary.webp) + +The buttons on the right have the following functions: + +- Add From File – Uploads passwords (one password per line) from a TXT file +- Save To File – Opens a Save As window to save the current configuration to a TXTt file at a + desired location +- Sort and Distinct – Automatically removes duplicates and sorts passwords in alphanumeric order +- Find – Use the textbox to search for a password +- Default List – Resets the password values to the original list provided during installation. This + discards any modifications. +- Remove All – Deletes all passwords from the window + +Click **OK** to push modifications to all active Threat Prevention Agents. Inactive Agents get the +updated list when they reconnect to the Enterprise Manager. Select **Cancel** to close the window +and discard your changes. + +#### Words List Dictionary Window + +The Words List Dictionary window is a global setting used across all EPE policies. It contains a +user provided global list of character substitutions found in passwords. This feature uses the +entries in the Substitutions Editor to check all permutations of a user entered password. If the +password matches a substitution rule, Threat Prevention blocks it. + +Click the **Modify List of Words for Character Substitution** button in the Rules area on the EPE +Settings window. The Words List Dictionary window opens. + +![Words List Dictionary window](/images/threatprevention/8.1/admin/configuration/wordslistdictionary.webp) + +You can add, remove, and modify passwords here. The buttons on the right have the following +functions: + +- Add From File – Uploads passwords (one password per line) from a TXT file +- Save To File – Opens a Save As window to save the current configuration to a TXTt file at a + desired location +- Sort and Distinct – Automatically removes duplicates and sorts passwords in alphanumeric order +- Find – Use the textbox to search for a password +- Remove All – Deletes all character substituted passwords from the window + +Click **OK** to push modifications to all active Threat Prevention Agents. Inactive Agents get the +updated list when they reconnect to the Enterprise Manager. Select **Cancel** to close the window +and discard your changes. + +#### Substitutions Editor Window + +The Substitutions Editor window is a global setting used across all EPE policies. This editor stores +character substitutions and their associated replacements as rules (i.e. A = @). The +Words List Dictionary applies these rules when checking all permutations of a user entered password. + +:::note +All entries in the sequence column must be unique. +::: + + +For example: if you add “Goal” to the Word List Dictionary and add A=@ and O=0 to the +substitutions editor, Threat Prevention blocks the pending passwords “Go@l” and “G0al”. + +Click the Modify Character Substitution Mapping button in the Rules area on the EPE Settings window. +The Substitution Editor window opens. + +![Substitution Editor window](/images/threatprevention/8.1/admin/configuration/substitutioneditor.webp) + +The Substitutions Editor has the following options: + +- Import – Imports a full set of the character substitutions from a user specified file +- Export – Saves the current set of character substitutions to a user specified file +- Reset to default – Resets the character substitutions to the original list provided during + installation. This discards any modifications. +- Insert – Displays a custom row for the user to enter Sequence and Replacement values + + :::note + Threat Prevention inserts the new row underneath the highlighted row. + ::: + + +- Delete – Removes a single row from the Substitutions Editor list. You can delete only one row at a + time. + +Click **OK** to save the changes and close the window. Click **Cancel** to close the window and +discard any changes. + +### Download and Configure the Have I Been Pwned Hash List + +If the Administration Console doesn't have internet access, you can manually download the HIBP +database. + +The Pwned Passwords Downloader is a .NET tool that downloads all Pwned Passwords hash ranges and +saves them offline, so you can use them without depending on the k-anonymity API. Use this tool to +get the latest breached hashes from the Have I Been Pwned (HIBP) database. + +See the [Have I Been Pwned](https://haveibeenpwned.com/) website for more information about the HIBP database. + +:::note +The +[Pwned Passwords Downloader](https://github.com/HaveIBeenPwned/PwnedPasswordsDownloader) +is a third party, open source tool, created by the HaveIBeenPwned team and distributed under a BSD +3-Clause License. You might experience issues during the hash download process, depending on your +threading settings or the load on the CloudFlare backend. The Pwned Passwords Downloader tool +automatically retries until it completes the download process. +::: + + +**Prerequisites** + +The Pwned Passwords Downloader has the following prerequisite: + +- Install .NET 6 before installing the + [Pwned Passwords Downloader](https://github.com/HaveIBeenPwned/PwnedPasswordsDownloader) tool. You + can download .NET 6 from Microsoft: + [https://dotnet.microsoft.com/en-us/download/dotnet/6.0](https://dotnet.microsoft.com/en-us/download/dotnet/6.0) + +The Have I Been Pwned database (HIBP) hashes can take up to 30 GB. Ensure that you have enough +free space on your disk. + +**Install the Pwned Passwords Downloader** + +To install the Pwned Passwords Downloader: + +**Step 1 –** Open command prompt, and navigate to your .NET install folder (for example, +`C:\Program Files (x86)\dotnet`). + +**Step 2 –** Run the following command: + +``` +dotnet tool install --global haveibeenpwned-downloader +``` + +![hibp_installation_0](/images/threatprevention/8.1/admin/configuration/hibp_installation_0.webp) + +**Step 3 –** Close the command prompt. + +**Update an Installed Pwned Passwords Downloader** + +To update an installed Pwned Passwords Downloader: + +**Step 1 –** Open the command prompt. + +**Step 2 –** Run the following command: + +``` +dotnet tool update --global haveibeenpwned-downloader +``` + +![hibp_installation_1](/images/threatprevention/8.1/admin/configuration/hibp_installation_1.webp) + +**Download NTLM Hashes with the Pwned Passwords Downloader** + +To download NTLM hashes: + +**Step 1 –** Navigate to the folder where you want to download the hashes. + +**Step 2 –** Download all NTLM hashes to a single txt file, called for example +`pwnedpasswords_ntlm.txt`. + +Run the following command: + +``` +haveibeenpwned-downloader.exe -n pwnedpasswords_ntlm +``` + +![hibp_installation_3](/images/threatprevention/8.1/admin/configuration/hibp_installation_3.webp) +This screenshot shows the completed download. + + +**Step 3 –** To overwrite an existing hash list, run the following command: + +``` +haveibeenpwned-downloader.exe -n pwnedpasswords_ntlm -o +``` + +For a complete list of available parameters, check the +[Pwned Passwords Downloader GitHub page](https://github.com/HaveIBeenPwned/PwnedPasswordsDownloader). diff --git a/docs/threatprevention/8.1/admin/configuration/eventfilteringconfiguration.md b/docs/threatprevention/8.1/admin/configuration/eventfilteringconfiguration.md new file mode 100644 index 0000000000..31bed13dcc --- /dev/null +++ b/docs/threatprevention/8.1/admin/configuration/eventfilteringconfiguration.md @@ -0,0 +1,190 @@ +--- +title: "Event Filtering Configuration Window" +description: "Event Filtering Configuration Window" +sidebar_position: 50 +--- + +# Event Filtering Configuration Window + +Use the Event Filtering Configuration window to exclude specific Active Directory and +Authentication events from monitoring. You can set a latency threshold to generate alerts for AD +events. + +:::note +This window is only available to Threat Prevention administrators. +::: + + +To enable event filtering: + +**Step 1 –** Click **Configuration** > **Event Filtering** on the menu to open the Event Filtering +Configuration window. + +![Event Filtering Configuration Window](/images/threatprevention/8.1/admin/configuration/eventfiltering.webp) + +**Step 2 –** The filter options are grouped by AD Global Pre Filters, Authentication Global Pre +Filters, and Alerts. Check the checkboxes to activate the filters and click **Save**. + +To disable a filter for diagnostic purposes, uncheck its checkbox and click **Save**. + +Click the Help icon (?) for an option in the AD Global Pre Filters area to view the type of “noise” +events the option filters. + +:::note +You must configure all Authentication Global Pre Filters options before you can enable +them. +::: + + +:::info +Enable all the AD Global Pre Filters options as well as the Exclude Logins from +Machine Accounts option in the Authentication Global Pre Filters section. +::: + + +When you activate a filter, the Agent filters out the event data according to the configurations in +the filters.json file in the Enterprise Manager installation directory. + +## Exclude ‘Noise’ Events Option + +The Exclude ‘Noise’ Events option is enabled by default to filter out login and internal low level +attributes that qualify as ‘noise’ events and bloat the database. You can +scope this option to include any combination of the following ‘noise’ events: + +- Successful AD User Logins – Excludes events with the following attributes where ‘objectClass’ + doesn't equal computer: + - logonCount + - lastLogon + - badPwdCount + - lastLogonTimestamp +- AD User Logins with Bad Password – Excludes events with the following set of attributes where + ‘objectClass’ doesn't equal computer: + - badPwdCount + - badPasswordTime +- AD Computer Logins – Excludes events with the following set of attributes where ‘objectClass’ + equals computer: + - logonCount + - lastLogon + - badPwdCount + - lastLogonTimestamp + - badPasswordTime + - badPwdCount +- Low Level Attributes – Excludes the following attributes from event: + - ImPwdHistory + - dBCSPwd + - ntPwdHistory + +## Exclude AD DNS Events Option + +The Exclude AD DNS Events option is enabled by default to filter out DNS events. These events can +bloat the database. Threat Prevention excludes only the events that meet both of the following +conditions: + +- objectClass = ‘dnsNode’ or ‘dnsZone’ +- Contains the ‘dnsRecord’ or ‘dNSTombstoned’ attribute + +When the Exclude AD DNS Events checkbox is unchecked, the Recent Events tab of the Active Directory +policy displays DNS record events in a human-readable format. To search +these results, set Affected Object: Class to equal dnsNode so the dnsRecord attribute +displays. + +## Don't Ignore Events With Unchanged Attributes + +The Don't Ignore Events With Unchanged Attributes option is disabled by default to filter out events where an attribute’s old value is equal to its new value. + +## Exclude Logins from Machine Accounts Option + +The Exclude Logins from Machine Accounts option is enabled by default to filter out machine logins. +These events can bloat the database. Click the **configure** link to open the Edit +Collection window. + +![Edit Collection window - For Machine Accounts](/images/threatprevention/8.1/admin/configuration/editcollectionmachineaccounts.webp) + +The Exclude Logins from Machine Accounts collection is only accessible through the Event Filtering +Configuration window. Either use the **Add** (+) button to open the +[Select Active Directory Perpetrators Window](/docs/threatprevention/8.1/admin/policies/configuration/eventtype/window/perpetrators.md) +to browse for machine accounts or enter the account name in the textbox. + +This filter only considers perpetrators with accounts ending in “$”. You can use wild cards (\*) +for partial matches to account names. + +The Agent either includes or excludes all machine accounts in the textbox from event data +monitoring. Machine accounts not in the list get the unselected property. + +Select one of the following radio buttons to apply to the list of account names: + +- Pass to agent on match – The Agent includes these accounts for event data monitoring. The Agent + excludes and ignores machine accounts not in the list. +- Remove on match – The Agent excludes and ignores these accounts. Threat Prevention includes + machine accounts not in the list and sends them to the Agent for event data monitoring. + +Repeat the process until you have entered all machine accounts to include in or exclude from +Authentication event data. Then click **OK**. + +**Usage Tip** + +Windows Server 2012 introduced gMSA (Group Managed Service Accounts). gMSA accounts include +“$” in their names, so by default Threat Prevention filters out authentication traffic generated by these accounts because they ‘look’ like machine accounts which before Server 2012 were the only account names ending in “$”. +In Threat Prevention, you can add a list of filter strings to the “Exclude Logins from Machine +Accounts” global filter to capture activity by gMSA type accounts, as this activity is +typically of interest whereas true ‘machine accounts’ aren't. Supplying either an explicit list +of gMSA account names or, if you have adopted a naming convention, a set of wild card strings such +as “gMSA\*” or “svc\*”, lets you capture authentication activity from such accounts while ignoring +the noisy ‘machine accounts’. + +## Exclude Authentication Events from Selected Hosts Option + +The Exclude Authentication Events from Selected Hosts option is disabled by default because you must +configure it before you can enable it. Click the **selected hosts** link to open the Edit +Collection window. + +![Edit Collection window - For Hosts](/images/threatprevention/8.1/admin/configuration/editcollectionhosts.webp) + +The Exclude Authentication Events from Hosts collection is only accessible through the Event +Filtering Configuration window. You must know all three methods of identification for a host (IP +address, NETBIOS host name, or DNS host name) to effectively exclude authentication from the +host. Identify the host to exclude in the textbox under the IP Address column and press **Enter** +or select the next row in the grid. Threat Prevention attempts to discover the NETBIOS host name and +the DNS host name associated with the supplied IP address. If Threat Prevention doesn't resolve the +host identification or resolves it inaccurately, enter the information manually. + +Repeat the process until you have entered all hosts for which Threat Prevention shouldn't collect +authentication event data. Then click **OK**. The Edit Collection window closes, and you can enable +the Exclude Authentication Events from selected hosts option. + +## Exclude Authentication Events from Selected Accounts Option + +The Exclude Authentication Events from Selected Accounts option is disabled by default because you +must configure it before you can enable it. Click the selected accounts link to open the Edit +Collection window. + +![Edit Collection window - For Selected Accounts](/images/threatprevention/8.1/admin/configuration/editcollectionaccounts_1.webp) + +The Exclude Authentication Events from Selected Accounts collection is only accessible through the +Event Filtering Configuration window. Use the **Add** (+) button to open the +[Select Active Directory Perpetrators Window](/docs/threatprevention/8.1/admin/policies/configuration/eventtype/window/perpetrators.md) +to browse for the accounts you want. You can also type account names [domain name\account] in the +textbox. You can use wild cards (\*) as part of either the domain name or account. Threat Prevention +treats an asterisk (\*) appearing anywhere other than as the first character or the last character +as a literal character rather than a wild card. For example: \*\Service1 would exclude all Service1 accounts +whether it is a domain or local account, and Example\Service\* would exclude all accounts that start +with “Service” for the Example domain. + +Repeat the process until you have entered all accounts to exclude from Authentication event data. +Then click OK. The Edit Collection window closes, and you can enable the Exclude +Authentication Events from selected accounts option. + +## AD Events Latency Threshold Option + +The Send Latency Alerts option is disabled by default. It generates alerts if the time +delay between when the Agent detects an AD event and when the Enterprise Manager receives it +exceeds the specified latency threshold. This option helps you troubleshoot slow connections in the +environment. These events can bloat the database, especially if you set the +latency threshold too low. + +Select the Send Latency Alerts checkbox to enable this option. Use the arrows, or type into the +textbox, to set the latency threshold in minutes for the time when the Agent detects the event and +the Enterprise Manager receives it. When events exceed the timeframe, alerts display in the +[Alerts Interface](/docs/threatprevention/8.1/admin/alerts/overview.md). To generate Email or SIEM alerts, select the +Agent Latency checkbox in the Operations tab of the +[System Alerting Window](/docs/threatprevention/8.1/admin/configuration/systemalerting/overview.md). diff --git a/docs/threatprevention/8.1/admin/configuration/eventsdatabaseconfiguration.md b/docs/threatprevention/8.1/admin/configuration/eventsdatabaseconfiguration.md new file mode 100644 index 0000000000..7ea358784d --- /dev/null +++ b/docs/threatprevention/8.1/admin/configuration/eventsdatabaseconfiguration.md @@ -0,0 +1,22 @@ +--- +title: "Events Database Configuration Window" +description: "Events Database Configuration Window" +sidebar_position: 40 +--- + +# Events Database Configuration Window + +The Events Database Configuration window manages the NVMonitorData database, also known as the +Events database. Click **Configuration** > **Database** > **Server** on the menu to open it. + +This window is only available to Threat Prevention administrators. + +![Events Database Configuration Window](/images/threatprevention/8.1/admin/configuration/eventsdatabaseconfig.webp) + +You originally configure the Event database when installing the Threat Prevention Enterprise Manager +package. See the [Application Server Install](/docs/threatprevention/8.1/install/application.md) topic for additional +information. This window displays the current connection settings for the Event database. + +You can change credentials and/or SQL Server host information in the DB Connection Manager +application. See the [DB Connection Manager Wizard](/docs/threatprevention/8.1/install/dbconnectionmanager.md) topic for +additional information. diff --git a/docs/threatprevention/8.1/admin/configuration/filemonitorsettings.md b/docs/threatprevention/8.1/admin/configuration/filemonitorsettings.md new file mode 100644 index 0000000000..9bcc19eab0 --- /dev/null +++ b/docs/threatprevention/8.1/admin/configuration/filemonitorsettings.md @@ -0,0 +1,103 @@ +--- +title: "File Monitor Settings Window" +description: "File Monitor Settings Window" +sidebar_position: 60 +--- + +# File Monitor Settings Window + +The File Monitor Settings window provides global settings for managing log retention, the ability to +disable office file filtering, inherited permissions for parent object changes, and AD accounts and +file system activity processes for Threat Prevention file monitoring and blocking policies. + +To configure file system monitoring: + +**Step 1 –** Click **Configuration** > **File Monitor Settings** on the menu; the File Monitor +Settings window opens. This window is only available to Threat Prevention administrators. + +![File Monitor Settings window](/images/threatprevention/8.1/admin/configuration/filemonitorsettings.webp) + +**Step 2 –** Enable or disable the following options: + +- Logs retention period, days – Log retention period for activity logs (TSV files) created by the + Threat Prevention Agent for Windows servers or by the Activity Monitor Agent for NAS devices and + then read by the Threat Prevention Agent. This doesn't affect File System Access Analyzer event + types. + The Threat Prevention Agent reads logs in real time and retains the original logs for a set number + of days before Threat Prevention automatically deletes them. This setting configures the log + retention period for all enabled policies using the File System Changes and/or File System + Lockdown event types. By default, it is 10 days. +- Microsoft Office temporary files filtering – Global setting that is checked by default. If + checked, Threat Prevention doesn't monitor the temporary files associated with Microsoft Office + operations, such as copy and paste. When unchecked, Threat Prevention monitors all temporary files + associated with Microsoft Office operations. +- FS inherited permissions filtering – Reports separate events for the parent object and each child + object. When checked, it reports an event only for the parent object. +- Exclude selected accounts – When checked, Threat Prevention excludes the user-supplied list of AD + user and group names, as well as well-known SIDs for built-in users/groups, from file system + monitoring and blocking policies at the global level. See the Select Local Processes to Exclude + topic to specify accounts. +- Exclude selected processes – When checked, Threat Prevention excludes the user-supplied list of + processes from the file system monitoring and blocking policies at the global level. See the + Select Local Processes to Exclude topic to specify processes. +- Include Folder read / list operations – When checked, Threat Prevention includes all list/read + folder operations in the reporting for file system monitoring and blocking at the global level. +- Ignore SYSTEM account for NTDS.DIT file – When checked, a File System monitoring policy doesn't + report access to the .dit file by the SYSTEM account, and a File System blocking policy doesn't + block it. Backup programs often use the SYSTEM account to access the .dit + file and you may not want to report on or block such activity. + +**Step 3 –** Click **Update** to save your changes. + +## Select Accounts to Exclude from Collections + +A collection is a list of SIDs for built-in users/groups that Threat Prevention excludes from all +File System activity. You can add more accounts to this collection. + +To populate the collection with accounts to exclude from File System +monitoring: + +**Step 1 –** Click **Configuration** > **File Monitor Settings** on the menu to launch the File +Monitor Settings window. + +**Step 2 –** Check the **Exclude selected accounts** checkbox and then click **accounts**. The Edit +Collection window opens. + +![File Monitor Settings > Edit Collection window (for accounts)](/images/threatprevention/8.1/admin/configuration/editcollectionaccounts.webp) + +**Step 3 –** Use the **Add** (+) button to open the +[Select Active Directory Perpetrators Window](/docs/threatprevention/8.1/admin/policies/configuration/eventtype/window/perpetrators.md) +to browse for and select AD accounts. + +**Step 4 –** Click **OK** to save your changes. + +**Step 5 –** Click **Update** on the File Monitor Settings window. + +Threat Prevention globally excludes any accounts you add to the list from File System activity. + +:::note +If the **Exclude selected processes** option is checked, Threat Prevention ignores the +File System activity generated by the processes you add. +::: + + +## Select Local Processes to Exclude + +To select local processes for exclusion from File System activity: + +**Step 1 –** Click **Configuration** > **File Monitor Settings** on the menu to launch the File +Monitor Settings window. + +**Step 2 –** Check the **Exclude selected processes** checkbox and then click **processes**. The +Edit Collection window opens. + +![File Monitor Settings > Edit Collection window (for processes)](/images/threatprevention/8.1/admin/configuration/editcollectionprocesses.webp) + +**Step 3 –** Use the Items textbox to enter process names. You must enter a process name exactly as +is; for example, as it appears on the Details tab of Windows Task Manager. + +**Step 4 –** Click **OK** to save your changes. + +**Step 5 –** Click **Update** on the File Monitor Settings window. + +Threat Prevention doesn't report the File System activity of any processes you add to the list. diff --git a/docs/threatprevention/8.1/admin/configuration/siemoutputviewer.md b/docs/threatprevention/8.1/admin/configuration/siemoutputviewer.md new file mode 100644 index 0000000000..67e8541676 --- /dev/null +++ b/docs/threatprevention/8.1/admin/configuration/siemoutputviewer.md @@ -0,0 +1,85 @@ +--- +title: "SIEM Output Viewer" +description: "SIEM Output Viewer" +sidebar_position: 70 +--- + +# SIEM Output Viewer + +The SIEM Output Viewer window displays the event data (messages) that Threat Prevention writes to +syslog (SIEM) in real time. + +- Threat Prevention sends event data generated for a policy to SIEM if you select the 'Send to SIEM' + option for that policy on the Actions tab. See the + [Send to SIEM](/docs/threatprevention/8.1/admin/policies/configuration/actions/overview.md#send-to-siem) topic for additional information. +- Threat Prevention sends event data generated for an analytic to SIEM if you select the 'Send Raw + Data to SIEM' option for that analytic on the Actions tab. See the + [Send to SIEM](/docs/threatprevention/8.1/admin/policies/configuration/actions/overview.md#send-to-siem) topic for additional information. +- Threat Prevention sends event data generated for an event/incident/policy to SIEM if you assign a + SIEM profile to it on the [SIEM Tab](/docs/threatprevention/8.1/admin/configuration/systemalerting/siem.md) of the System Alerting Window. + +While you can also use third-party tools like +[Kiwi Syslog Server](https://www.solarwinds.com/free-tools/kiwi-free-syslog-server) to view the +output, the SIEM Output Viewer window may serve as a troubleshooting tool to view and verify the +actual data Threat Prevention sends to syslog (SIEM) in real time. + +To view real time data (messages) that Threat Prevention sends to SIEM: + +**Step 1 –** Click **Configuration** > **SIEM Output Viewer** on the menu; the SIEM Output Viewer +window opens. This window is only available to Threat Prevention administrators. + +![SIEM Output Viewer window](/images/threatprevention/8.1/admin/configuration/siemoutputviewer.webp) + +**Step 2 –** Click **Start**. As events occur and Threat Prevention writes to syslog (sends +event/policy/analytics data to SIEM) in real time, the window displays them. + +**Step 3 –** The **Autoscroll** checkbox enables or disables automatic scrolling of the log display. + +- When enabled, the SIEM Output Viewer window automatically scrolls down to show the latest incoming + messages in real time. +- When disabled, you must scroll manually and review log entries without the display + automatically jumping to the newest message. + +**Step 4 –** For each message, the window displays the following: + +- Event: Time Logged – Timestamp for when the event was monitored/blocked. The specified time is the + local time for the server where the Agent is deployed.Hover over the data in this column to view + the local time (of the Enterprise Manager) and UTC time simultaneously. +- Host – The IP address or name of the SIEM server, configured in the SIEM server settings +- Port – The port number to communicate with the SIEM server, configured in the SIEM server settings +- Protocol – The protocol set when configuring the SIEM server, i.e., TCP or UDP +- SSL – Shows whether Threat Prevention uses SSL when sending data to SIEM (applies if TCP is set as the protocol) +- Message – The actual data sent to syslog +- Status – This field is empty if the message sends successfully. Otherwise, it contains the + text of the received error, for example, 'Connection timeout' + +You can select a row and use Ctrl+C to copy the data displayed in it. Then paste it to another +application like Notepad to examine it in detail. + +:::note +The host, port, protocol, and SSL columns display the settings configured for the SIEM +server where the respective message is sent. See the +[Configure a SIEM Server ](/docs/threatprevention/8.1/admin/configuration/systemalerting/siem.md#configure-a-siem-server) topic for additional +information. +::: + + +This data grid employs features for sorting, filtering, searching, and more. + +- Right-click anywhere in the column header to get a menu with several options to sort the data in + the grid. See the + [Data Grid Right-Click Menu](/docs/threatprevention/8.1/admin/navigation/rightclickmenus.md#data-grid-right-click-menu) topic + for additional information. +- The Group by Box ribbon above the header row affects how much data the grid displays. See the + [Sort Data](/docs/threatprevention/8.1/admin/navigation/datagrid.md#sort-data) topic for additional information. +- You can reorder columns and remove them from the data grid. You can add removed columns back + through the [Customization Window](/docs/threatprevention/8.1/admin/navigation/datagrid.md#customization-window). +- The Search icon opens the **Enter text to search…** textbox where you can search for the required + data in the data grid. See the [Search Data](/docs/threatprevention/8.1/admin/navigation/datagrid.md#search-data) topic for + additional information. + +**Step 5 –** Click **Save** to save the displayed data to a text file or **Clear** to clear the +data. + +When you click **Save**, the Save As dialog box opens, where you can select a location to save +the text file. diff --git a/docs/threatprevention/8.1/admin/configuration/systemalerting/_category_.json b/docs/threatprevention/8.1/admin/configuration/systemalerting/_category_.json new file mode 100644 index 0000000000..4e8e958d45 --- /dev/null +++ b/docs/threatprevention/8.1/admin/configuration/systemalerting/_category_.json @@ -0,0 +1,10 @@ +{ + "label": "System Alerting Window", + "position": 100, + "collapsed": true, + "collapsible": true, + "link": { + "type": "doc", + "id": "overview" + } +} \ No newline at end of file diff --git a/docs/threatprevention/8.1/admin/configuration/systemalerting/email.md b/docs/threatprevention/8.1/admin/configuration/systemalerting/email.md new file mode 100644 index 0000000000..2f3b1da1e6 --- /dev/null +++ b/docs/threatprevention/8.1/admin/configuration/systemalerting/email.md @@ -0,0 +1,210 @@ +--- +title: "Email Tab" +description: "Email Tab" +sidebar_position: 10 +--- + +# Email Tab + +Alert notification via email sends messages through an SMTP gateway. Alerts send email notifications +to individuals or groups. + +To configure the Email tab of the System Alerting window: + +**Step 1 –** Click **Configuration** > **Alerts** on the menu. The Netwrix Threat Prevention System +Alerting window opens. The Email tab displays by default. + +![Netwrix Threat Prevention System Alerting window](/images/threatprevention/8.1/admin/configuration/systemalerting/systemalerting.webp) + +**Step 2 –** Configure the following before enabling email alerting: + +- Configure SMTP Host Information +- Create Message Profiles + +**Step 3 –** After you configure both, click **Events** on the **Email** tab. Decide what events receive +notifications and assign one or more message profiles to the event. + +**Step 4 –** Click the button next to Disabled to toggle the setting to **Enabled**. + +**Step 5 –** Select an event category (Security, Operations, Configuration, Analytics, Policies) in +the left pane. + +**Step 6 –** Check the checkbox for the event/incident/policy for which you want to trigger email +notifications. + +**Step 7 –** Click the **Select Profile, please** option for an event/incident/policy and select a +Message Profile from the dropdown menu to assign it to the event/incident/policy. When Threat +Prevention generates an alert for the event/incident/policy, it sends an email to all recipients +specified in the Message Profile. + +- For policies, you can assign multiple profiles by either checking the profiles you want or the + Select All option. Click **OK** in the dropdown menu to confirm the selection. + +You can assign a profile to as many events as required. + +**Step 8 –** For the Security, Operations, and Configuration event categories, the Suppression time +option is also available for each event. Use it to prevent Threat Prevention from generating alerts +for an event for a specified time period. This limits the volume of repeat alerts for the respective +event. + +Click **Suppression time** for an event and select an option from the dropdown menu: + +- A duration ( 1 min, 2 min, 5 min, 10 min, 30 min, 60 min) – After Threat Prevention generates an + alert for the event, it doesn't generate another alert for it during the next X minutes (X is + the duration you selected) even if the event occurs. +- Disabled – Threat Prevention doesn't suppress alerts + +**Example** + +You select a suppression time of 30 minutes for an event. Threat Prevention then generates an alert +for that event. If the event occurs again within the next 30 minutes, Threat Prevention doesn't +generate another alert. + +Use the suppression time feature to handle situations where an event such as Agent Latency generates +numerous alerts and freezes the Enterprise Manager and Administration Console. + +**Step 9 –** For Analytics, choose whether to enable Ongoing Attack Alerts. When checked, +Threat Prevention sends periodic reminders of an ongoing attack if it continues after the initial +notification. + +**Step 10 –** Click **OK** to save the settings. + +Threat Prevention now sends email notifications for the selected events/incident/policies to the +recipients of the selected Message Profiles. + +### Configure SMTP Host Information + +To configure the SMTP host information for email alerting: + +:::tip +This is a one-time setting to enable email alerts from the Administration Console. +::: + + +![System Alerting window - Email tab - Configure SMTP Host and Message Profile](/images/threatprevention/8.1/admin/configuration/systemalerting/smtphost.webp) + +**Step 1 –** Click **Configuration** > **Alerts** on the menu. The Netwrix Threat Prevention System +Alerting window opens. + +**Step 2 –** On the Email tab, click **Configure**. + +**Step 3 –** In the Server section, provide the SMTP Host as either the IP address or the hostname +of the SMTP gateway. Example: 192.168.189.56 or SIM1.netwrix.com + +**Step 4 –** In the **Port** box, provide the appropriate port number. + +**Step 5 –** Check the **Enable SSL** checkbox to use SSL communications for email. + +**Step 6 –** In the **From** box, enter the email address to use as the sender for the email. +Example: Threat Prevention@Netwrix.com + +**Step 7 –** If the SMTP gateway requires authentication, check the **Requires Authentication** +checkbox and provide a username and password in the boxes that appear. + +**Step 8 –** Click **OK** to save the settings. + +### Create Message Profiles + +You associate Message Profiles with events for email alerting. To create a Message +Profile: + +:::note +When you modify the Message Profile for an alert, all policies referencing the alert use +the updated information. +::: + + +![System Alerting window - Email tab - Configure SMTP Host and Message Profile](/images/threatprevention/8.1/admin/configuration/systemalerting/smtphost.webp) + +**Step 1 –** Click **Configuration** > **Alerts** on the menu. The Netwrix Threat Prevention System +Alerting window opens. + +**Step 2 –** On the Email tab, click **Configure**. + +**Step 3 –** In the Message Profiles area, click the **Add** (+) button to create a Message Profile. +The default profile name (New Email Notification) displays. + +:::info +Provide a unique and descriptive name for this new email notification profile. +::: + + +**Step 4 –** Choose between **Plain Text** and **HTML** email options. The Email Template window +displays when selecting either radio button. + +![Email Template window](/images/threatprevention/8.1/admin/configuration/systemalerting/emailtemplate.webp) + +Changing the message template provides the option to load the default message template. Choose +between: + +- Yes – Loads the default message template for the selected format. This overwrites the current + message template. +- No – Leads the current message body + +**Step 5 –** In the To box, provide an email address for each recipient of the email alert. This can +be individuals, distribution lists, or a combination. To send alerts to multiple recipients, +separate the addresses with either a comma (,) or a semi-colon (;). Example: IT@netwrix.com; +ITdl@netwrix.com + +**Step 6 –** Click the Send Test Email link to send a test email. It sends an unformatted sample +message to all recipients. Threat Prevention informs you if the message sends successfully, but +can't tell you whether the recipient received it. + +**Step 7 –** In the Subject box, keep the default subject line for the email or provide one that is +more suitable for the alerts these recipients receive. + +**Step 8 –** The Body box contains the default message, which includes all event data types +available for notification. To customize it for specific alerts, remove the Event Data +Fields you don't need. You can also reformat the message. The default +message is: + +- Plain Text – An event has occurred in which you are on the notification list. +- HTML – The following Event has occurred at %TIME_STAMP% for which you requested notification + +The available Event Data Fields and their associated tokens are: + +| Event Data Field | Token | +| ---------------------------- | ------------------------------ | +| Time Stamp | %TIME_STAMP% | +| Event Source Type | %EVENT_SOURCE_TYPE% | +| Domain Name | %EVENT_SOURCE_NAME% | +| Policy Name | %SETTING_NAME% | +| Event Name | %EVENT_NAME% | +| Event Name Translated | %EVENTNAMETRANSLATED% | +| Originating Server | % ORIGINATING_SERVER% | +| Originating Server IP | %ORIGINATING_SERVERIP% | +| Target Host | %TARGETHOST% | +| Target Host IP | %TARGETHOSTIP% | +| Class Name | %CLASS_NAME% | +| DN | %DN% | +| Affected Object SID | %AFFECTED_OBJECT_SID% | +| Affected Object Account Name | %AFFECTED_OBJECT_ACCOUNT_NAME% | +| Operation Successful | %SUCCESS% | +| Operation Status | %STATUS% | +| Blocked Event | %BLOCKED_EVENT% | +| Perpetrator | %PERPETRATOR% | +| Perpetrator Name | %PERPETRATOR_NAME% | +| Perpetrator Sid | %PERPETRATOR_SID% | +| Originating Client | %ORIGINATING_CLIENT% | +| Originating Client Host | %ORIGINATINGCLIENTHOST% | +| Originating Client IP | %ORIGINATINGCLIENTIP% | +| Originating Client Protocol | %ORIGINATINGCLIENTPROTOCOL% | +| Originating Client MAC | %ORIGINATINGCLIENTMAC% | +| Events Count | %EVENTS_COUNT% | +| Attribute Values | %ATTRIBUTE_VALUE% | +| Old Attribute Values | %OLD_ATTRIBUTE_VALUE% | +| Attribute Operations | %OPERATION% | + +:::warning +The tokens used within the message Body, the information between and including the % +symbols (e.g. %TIME_STAMP%), must be present to retrieve that event data from the database. You can +remove tokens, but partial tokens don't retrieve data from the database. +::: + + +**Step 9 –** Click **OK** to save the settings. + +Now that you have created at least one Message Profile, you can assign it to an event +through the System Alerting window’s Email tab, or assign it to a policy on the +[Actions Tab](/docs/threatprevention/8.1/admin/policies/configuration/actions/overview.md) of the policy configuration or the +[Actions Tab](/docs/threatprevention/8.1/admin/templates/configuration/actions.md) of the template configuration. diff --git a/docs/threatprevention/8.1/admin/configuration/systemalerting/eventlog.md b/docs/threatprevention/8.1/admin/configuration/systemalerting/eventlog.md new file mode 100644 index 0000000000..481224f910 --- /dev/null +++ b/docs/threatprevention/8.1/admin/configuration/systemalerting/eventlog.md @@ -0,0 +1,49 @@ +--- +title: "Event Log Tab" +description: "Event Log Tab" +sidebar_position: 20 +--- + +# Event Log Tab + +Alert notification via Event Log sends event notifications to the Windows Event Log. Follow the +steps to enable Event Log alerting. + +![System Alerting window – Event Log tab](/images/threatprevention/8.1/admin/configuration/systemalerting/eventlog.webp) + +**Step 1 –** Click **Configuration** > **Alerts** on the menu. The Netwrix Threat Prevention System +Alerting window opens. + +**Step 2 –** Click the **Event Log** tag. + +**Step 3 –** Click the button next to Disabled to toggle the setting to **Enabled**. + +**Step 4 –** Select an event category (Security, Operations, Configuration) in the left pane. + +**Step 5 –** Check the checkboxes for the events for which you want to trigger Windows Event Log +notifications. + +**Step 6 –** For the Security, Operations, and Configuration event categories, the Suppression time +option is also available for each event. Use it to prevent Threat Prevention from generating alerts +for an event for a specified time period. This limits the volume of repeat alerts for the respective +event. + +Click **Suppression time** for an event and select an option from the dropdown menu: + +- A duration ( 1 min, 2 min, 5 min, 10 min, 30 min, 60 min) – After Threat Prevention generates an + alert for the event, it doesn't generate another alert for it during the next X minutes (X is + the duration you selected) even if the event occurs. +- Disabled – Threat Prevention doesn't suppress alerts + +**Example** + +You select a suppression time of 30 minutes for an event. Threat Prevention then generates an alert +for that event. If the event occurs again within the next 30 minutes, Threat Prevention doesn't +generate another alert. + +Use the suppression time feature to handle situations where an event such as Agent Latency generates +numerous alerts and freezes the Enterprise Manager and Administration Console. + +**Step 7 –** Click **OK** to save the settings. + +The Windows Event Log now receives alert notifications for the checked events. diff --git a/docs/threatprevention/8.1/admin/configuration/systemalerting/overview.md b/docs/threatprevention/8.1/admin/configuration/systemalerting/overview.md new file mode 100644 index 0000000000..56e4da376a --- /dev/null +++ b/docs/threatprevention/8.1/admin/configuration/systemalerting/overview.md @@ -0,0 +1,97 @@ +--- +title: "System Alerting Window" +description: "System Alerting Window" +sidebar_position: 100 +--- + +# System Alerting Window + +The System Alerting window is only available to administrators, enabling them to configure and +manage all alerting avenues. Click **Configuration** > **Alerts** on the menu to open it. + +![Netwrix Threat Prevention System Alerting window](/images/threatprevention/8.1/admin/configuration/systemalerting/systemalerting.webp) + +Threat Prevention can send alerts to recipients via email, to the Windows Event Log, and to SIEM +products. Alerts are grouped into five types: + +- Security – Provides alerts on things that impact: + + - What data Threat Prevention collects + - The ability to collect the data + - Changes to who can access it + +- Operations – Provides alerts on internal operations of the product that a user doesn't directly + influence +- Configuration – Provides alerts on changes to general configuration settings +- Analytics – Provides alerts when an analytic incident triggers. These alerts aren't available + for Event Log alerts. +- Policies – Provides alerts when a policy monitors or blocks an event. These alerts aren't + available for Event Log alerts. + +## Email and SIEM Alert Notifications for Policy Events + +You can enable email and SIEM alert notifications for policy events through: + +- The System Alerting window +- The [Actions Tab](/docs/threatprevention/8.1/admin/policies/configuration/actions/overview.md) of a policy +- The [Actions Tab](/docs/threatprevention/8.1/admin/templates/configuration/actions.md) of a policy template + +In any case, you must first set the configuration through the System Alerting window. The +[Alerts Interface](/docs/threatprevention/8.1/admin/alerts/overview.md) shows recent alerts in a +centralized location. + +## Email and SIEM Alert Notifications for Analytic Incidents + +You can configure email and SIEM alert notifications for Analytic incidents through the System +Alerting window to send Ongoing Attack Alerts. In this case, Threat Prevention sends periodic +reminders of an ongoing attack if it continues after the initial notification. + +## View the Alert Notifications + +Threat Prevention generates notifications for the alerts you enable on the System Alerting window. + +- The [Alerts Interface](/docs/threatprevention/8.1/admin/alerts/overview.md) displays all Security, Configuration, and Operation + alert notifications. +- The [Analytics Interface](/docs/threatprevention/8.1/admin/analytics/overview.md) displays all Analytics incidents. +- The [Investigate Interface](/docs/threatprevention/8.1/admin/investigate/overview.md) displays all Policies events. + +## General Considerations + +Consider the following: + +- Occasionally a Microsoft Security Bulletin impacting LSASS can interfere with the Agent + instrumentation resulting in LSASS shutting down. The Agent is configured to monitor for an LSASS + process termination shortly after a server reboot. The + [LSASS Process Terminated](/docs/threatprevention/8.1/troubleshooting/lsass.md) alert (Operations alert) + triggers in this event and the Agent stops. As a result, all monitoring/blocking by that + Agent stops. To resolve the issue, either upgrade to the latest version of the Agent or + upgrade SI.ActiveDirectoryMonitor.dll - commonly known as ADMonitor DLL (recommended). See the + [Upgrade ADMonitor](/docs/threatprevention/8.1/admin/agents/agent-management/upgradeadmonitor.md)topic for additional information. + + :::info + Activate an email notification for the _LSASS process terminated_ alert. See + the + [Enable the 'LSASS Process Terminated' Email Alert](/docs/threatprevention/8.1/troubleshooting/lsass.md#enable-the-lsass-process-terminated-email-alert) + topic for additional information. + ::: + + +- In addition to the LSASS process termination check, you can configure the Agent for a Safe Mode. + In Safe Mode, the Agent records the version of the LSASS DLLs that it hooks into during + installation. When you restart an Agent, it compares the DLL versions with the recorded list. If + the versions don't match, the Windows AD Events monitoring module doesn't load. The Agent’s + status in the Agents interface changes to Active (Modules Pending), and all Active Directory + monitoring/blocking by that Agent stops. The 'Agent Started in AD Monitor pending mode' alert + (Operations alert) triggers in this event. To resolve the issue temporarily, the Threat + Prevention administrator should start the pending modules. See the + [Start Pending Modules](/docs/threatprevention/8.1/admin/agents/agent-management/startpendingmodules.md) topic for additional + information. Netwrix also recommends upgrading SI.ActiveDirectoryMonitor.dll (commonly known as + ADMonitor DLL) to resolve the issue permanently. See the + [Upgrade ADMonitor](/docs/threatprevention/8.1/admin/agents/agent-management/upgradeadmonitor.md) topic for additional information. + + :::info + Activate an email notification for this alert. See the + [Enable Agent Started in AD Monitor Pending Mode Email Alert](/docs/threatprevention/8.1/admin/agents/safemode.md#enable-agent-started-in-ad-monitor-pending-mode-email-alert) + topic and the [Agent Safe Mode](/docs/threatprevention/8.1/admin/agents/safemode.md) topic for additional information. + + ::: diff --git a/docs/threatprevention/8.1/admin/configuration/systemalerting/siem.md b/docs/threatprevention/8.1/admin/configuration/systemalerting/siem.md new file mode 100644 index 0000000000..87184ba625 --- /dev/null +++ b/docs/threatprevention/8.1/admin/configuration/systemalerting/siem.md @@ -0,0 +1,190 @@ +--- +title: "SIEM Tab" +description: "SIEM Tab" +sidebar_position: 30 +--- + +# SIEM Tab + +Alert notification via SIEM sends event notifications to a SIEM product using UDP or TCP protocol. +Before you can enable SIEM alerting, you must configure the SIEM server. + +To set up what events receive notifications: + +**Step 1 –** Click **Configuration** > **Alerts** on the menu. The Netwrix Threat Prevention System +Alerting window opens. + +**Step 1 –** Click the **SIEM** tab. + +**Step 2 –** Click **Configure** to configure a SIEM server. See the Configure a SIEM Server topic +for additional information. + +**Step 3 –** After you configure the server, click **Events** on the **SIEM** tab. + +![Netwrix Threat Prevention System Alerting window - SEIM tab](/images/threatprevention/8.1/admin/configuration/systemalerting/seim.webp) + +**Step 4 –** Click the button next to Disabled to toggle the setting to **Enabled**. + +**Step 5 –** Select an event category (Security, Operations, Configuration, Analytics, Policies) in +the left pane. + +You can set a SIEM mapping file for each type of event category, as discussed in the Configure a +SIEM Server topic. + +**Step 6 –** Check the checkbox for the event/incident/policy for which you want to trigger SIEM +notifications. + +**Step 7 –** Click the **Select Profile, please** dropdown menu for an event/incident/policy and +select a SIEM Profile to assign to it. When Threat Prevention generates an alert for the +event/incident/policy, it sends a notification to the SIEM server specified in the SIEM Profile. + +- For policies, you can assign multiple profiles by either checking the profiles you want or the + Select All option. Click **OK** in the dropdown menu to confirm the selection. + +You can assign a profile to as many events as required. + +**Step 8 –** For the Security, Operations, and Configuration event categories, the Suppression time +option is also available for each event. Use it to prevent Threat Prevention from generating alerts +for an event for a specified time period. This limits the volume of repeat alerts for the respective +event. + +Click **Suppression time** for an event and select an option from the dropdown menu: + +- A duration ( 1 min, 2 min, 5 min, 10 min, 30 min, 60 min) – After Threat Prevention generates an + alert for the event, it doesn't generate another alert for it during the next X minutes (X is + the duration you selected) even if the event occurs. +- Disabled – Threat Prevention doesn't suppress alerts + +**Example** + +You select a suppression time of 30 minutes for an event. Threat Prevention then generates an alert +for that event. If the event occurs again within the next 30 minutes, Threat Prevention doesn't +generate another alert. + +Use the suppression time feature to handle situations where an event such as Agent Latency generates +numerous alerts and freezes the Enterprise Manager and Administration Console. + +**Step 9 –** For Analytics, choose whether to enable Ongoing Attack Alerts. When checked, +Threat Prevention sends periodic reminders of an ongoing attack if it continues after the initial +notification. + +**Step 10 –** Click **OK** to save the settings. + +Threat Prevention now sends SIEM notifications for the selected events/incidents/policies to the +SIEM product configured in the assigned SIEM profile. The +[SIEM Output Viewer](/docs/threatprevention/8.1/admin/configuration/siemoutputviewer.md) window also displays all notifications sent to SIEM. + +## Configure a SIEM Server + +You can create multiple profiles across SIEM servers to serve different alerting functions. Follow +the steps to configure one or more SIEM servers for alerting. + +![Netwrix Threat Prevention System Alerting window – SEIM tab – Configure SEIM Server](/images/threatprevention/8.1/admin/configuration/systemalerting/seimserver.webp) + +**Step 1 –** Click **Configuration** > **Alerts** on the menu. The Netwrix Threat Prevention System +Alerting window opens. + +**Step 1 –** On the SIEM tab, click **Configure**. + +**Step 2 –** In the SIEM Profiles area, click the Add (+) button to create a new SIEM profile. To +rename the default text, select the name string and enter the new profile name. + +:::info +For each profile, use a unique name for easy identification. +::: + + +**Step 3 –** Use the Protocol dropdown menu to select either protocol: + +- UDP +- TCP – If selected, the Require SSL/TLS checkbox displays. If needed, check this box and + ensure the certificate is saved in the certificate store. + +**Step 4 –** In the Host Address box, provide either an IP address or server name for the SIEM +server. + +**Step 5 –** In the Port box, provide the port number to communicate with the SIEM server. + +**Step 6 –** Use the Mapping File for Events dropdown menu to select the SIEM product to receive +policy event notifications. Use the gear icon to the right of the dropdown to import a +custom mapping file. These mapping file formats are specifically designed for policy events. + +**Step 7 –** Use the Mapping File for System Alerts dropdown menu to select the SIEM product to +receive Threat Prevention Security, Threat Prevention Operations, and Threat Prevention +Configuration event alerts. + +Use the gear icon to the right of the dropdown to import a custom mapping file. These +mapping file formats are specifically designed for Threat Prevention system events. + +**Step 8 –** Use the Mapping File for Authentication Analytics dropdown menu to select the SIEM +product to receive Authentication Analytics incident alerts. + +Use the gear icon to the right of the dropdown to import a custom mapping file. These +mapping file formats are specifically designed for Analytics incidents. + +**Step 9 –** Use the Mapping File for File Analytics dropdown menu to select the SIEM product to +receive File Analytics incident alerts. + +Use the gear icon to the right of the dropdown to import a custom mapping file. These +mapping file formats are specifically designed for Analytics incidents. + +**Step 10 –** _(Optional)_ Use the **Test** button to confirm the configuration settings. + +**Step 11 –** Click **OK** to save the settings. + +After you configure a SIEM server, assign it to events using the System Alerting window’s SIEM Tab or +the [Actions Tab](/docs/threatprevention/8.1/admin/policies/configuration/actions/overview.md) of a policy or the +[Actions Tab](/docs/threatprevention/8.1/admin/templates/configuration/actions.md) of a policy template. + +**IBM QRadar Integration** + +Netwrix has created a custom app for integration between Threat Prevention and QRadar. See the +[Active Directory App for QRadar](/docs/threatprevention/8.1/siemdashboard/qradar/overview.md) topic for additional +information. There is also a custom app for File Activity, that can receive data from either Threat +Prevention or Netwrix Activity Monitor. See the +[Netwrix Activity Monitor Documentation](https://helpcenter.netwrix.com/category/activitymonitor) +for additional information. + +**Splunk Integration** + +Netwrix has created custom apps for integration between Threat Prevention and Splunk. See the +[Active Directory App for Splunk](/docs/threatprevention/8.1/siemdashboard/activedirectory/overview.md) topic +and the [Threat Hunting App for Splunk](/docs/threatprevention/8.1/siemdashboard/threathunting/overview.md) +topic for additional information. There is also a custom app for File Activity, that can receive +data from either Threat Prevention or Netwrix Activity Monitor. See the +[Netwrix Activity Monitor Documentation](https://helpcenter.netwrix.com/category/activitymonitor) +for additional information. + +## Add a Custom SIEM Mapping File + +You can add custom SIEM mapping files. First create the mapping file and save it at a location +that the Administration Console can access. Threat Prevention stores the default mapping files in +the following folder: + +**…\Netwrix\Netwrix Threat Prevention\SIWinConsole\SIEMTemplates\** + +To add a custom SIEM mapping file: + +![SIEM tab - Gear icon for Custom Mapping File](/images/threatprevention/8.1/admin/configuration/systemalerting/geariconformappingfile.webp) + +**Step 1 –** Click **Configuration** > **Alerts** on the menu. The Netwrix Threat Prevention System +Alerting window opens. + +**Step 2 –** On the SIEM tab, click **Configure**. + +**Step 3 –** Click the **gear** icon for an alert type to open the SIEM Templates window. The new +mapping file is only available for the specific type you select. + +![SIEM Templates window](/images/threatprevention/8.1/admin/configuration/systemalerting/siemtemplates.webp) + +**Step 4 –** Click **Add** (+) to open the Import SIEM Mapping File window. + +![Import SIEM Mapping File window](/images/threatprevention/8.1/admin/configuration/systemalerting/importfile.webp) + +**Step 5 –** Select the mapping file you want and click **Open**. The SIEM Mapping File window closes +and the selected mapping file appears in the SIEM Templates window. It is now available in the +dropdown menu. Click **Close**. + +**Step 6 –** Click **OK** to save the settings. + +You can now select the new mapping file from the dropdown menu for the respective alert type. diff --git a/docs/threatprevention/8.1/admin/configuration/threatmanagerconfiguration.md b/docs/threatprevention/8.1/admin/configuration/threatmanagerconfiguration.md new file mode 100644 index 0000000000..82a1e87c77 --- /dev/null +++ b/docs/threatprevention/8.1/admin/configuration/threatmanagerconfiguration.md @@ -0,0 +1,161 @@ +--- +title: "Netwrix Threat Manager Configuration Window" +description: "Netwrix Threat Manager Configuration Window" +sidebar_position: 80 +--- + +# Netwrix Threat Manager Configuration Window + +The Netwrix Threat Manager Configuration window is a global setting to enable integration between +Threat Prevention and Threat Manager. This window is only available to Threat Prevention +administrators. + +**Threat Manager App Token** + +The Threat Manager App Token authenticates connection between Threat Prevention and Threat Manager. +You generate this token in Threat Manager: + +- In Threat Manager, navigate to the **Configuration** > **App Tokens** page. +- Generate a new app token. +- Copy the token. + +## Event Sink Tab + +The Event Sink tab connects Threat Prevention to Threat Manager through a uniform resource +identifier and the Threat Manager App Token. Threat Prevention sends policy event data to Threat +Manager through this window. + +To configure Threat Prevention to send event data to Threat Manager: + +**Step 1 –** Generate the Threat Manager App Token in Threat Manager. + +**Step 2 –** In Threat Prevention, click **Configuration** > **Netwrix Threat Manager +Configuration** on the menu. The Netwrix Threat Manager Configuration window opens with the Event +Sink tab displayed by default. + +![Netwrix Threat Manager Configuration window - Event Sink tab](/images/threatprevention/8.1/admin/configuration/threatmanagerconfiguration.webp) + +**Step 3 –** In the Netwrix Threat Manager URI box, enter the Threat Manager hostname or IP address +and port in the following format. The default port for Threat Manager is **10001**. + +- amqp://[HOSTNAME | IPADDRESS]:[PORT] + - For an example with the host name – amqp://ExampleHost:10001 + - For an example with the host address – amqp://192.168.9.52:10001 + +:::warning +Don't use localhost for the hostname or 127.0.0.1 for the IP address. +::: + + +**Step 4 –** You can enable SSL for the AMQP event stream. + +Because Threat Manager supports TLS/SSL, you can enable SSL in Threat Prevention to communicate with +Threat Manager securely. + +- If Threat Manager has TLS enabled, then select the **Enable SSL** checkbox to enable the Agent to + send events to Threat Manager. Otherwise, the Agent throws an error when connecting. +- Select the **Ignore Certificate Errors** checkbox to ignore certificate errors that may arise when + the Agent connects to Threat Manager. If this checkbox isn't selected, the Agent fails to + connect when there are certificate errors. + +**Step 5 –** In the App Token box, enter the App Token generated on the App Tokens page in Threat +Manager. + +**Step 6 –** The Policies area lists all the policies created in Threat Prevention. +The area displays the following for each policy: + +- Send – When this checkbox is selected, the policy sends the event data to Threat Manager directly + from the Agent. You can also set this option with the Send to Netwrix Threat Manager checkbox on + the Actions tab of a policy. +- State – Displays whether the policy is enabled or disabled + The State column doesn't control the state of the policy. You can enable or disable a policy + either on the General tab of the respective policy or through the Policies Node Right-Click Menu. +- Name –Shows the display name of the policy +- Path – Displays the path of the policy within the structure of the Policies node in the left pane. + +**Step 7 –** Click **Save**. + +Threat Prevention now sends all real-time event data from the selected policies to Threat +Manager. + +:::note +You can also use the Threat Manager URI configuration to send Threat Prevention policy +data to the Activity Monitor host and port (example: amqp://localhost:4499). Threat Prevention can +only send to either Threat Manager or the Activity Monitor. +::: + + +## Honey Token Tab + +On the Honey Token tab, you specify a samAccountName, which Threat Prevention substitutes with the +replacement samAccountName you provide. Threat Prevention sends the information on this tab to the +Threat Prevention Agent. +If the Agent sees an LDAP query using information from the Honey Token of fake accounts, it alters +the LDAP query results to return the Replacement samAccountName. This ensures the account looks like +a real privileged account to lure the perpetrator to it. + +To send the Honey Token to Threat Manager for an LDAP Deception trap: + +**Step 1 –** Configure the Source samAccountName and Replacement samAccountName in a Threat Manager +Honey Token threat. + +To set up a honey token, see the Configure Honeytoken Threats topic in the +[Netwrix Threat Manager Documentation](https://helpcenter.netwrix.com/category/stealthdefend). + +**Step 2 –** In Threat Prevention, click **Configuration** > **Netwrix Threat Manager +Configuration** on the menu. The Netwrix Threat Manager Configuration window opens. + +**Step 3 –** Ensure the Event Sink tab is properly set up to send event data to Threat Manager. + +**Step 4 –** Click the **Honey Token** tab. + +![Netwrix Threat Manager Configuration Window - Honey Tokem tab](/images/threatprevention/8.1/admin/configuration/honeytoken.webp) + +**Step 5 –** Check the **Enable LDAP substitution** checkbox to enable the options on the tab. + +**Step 6 –** Enter the exact match of settings configured for the Threat Manager Honey Token threat +for the following options: + +- Exact Match or Substring +- Source samAccountName +- Replacement samAccountName + +**Step 7 –** Click **Save**. + +The Honey Token is now enabled and integrated with Threat Manager. + +## Forged PAC Tab + +The Forged PAC tab provides the option to include Forged PAC information in the events Threat +Prevention sends to Threat Manager. + +To include the Forged PAC information in events: + +**Step 1 –** Under the Analytics node in the left pane, select the **Forged PAC** analytic. + +**Step 2 –** On the Forged PAC analytics window, select the gear icon on the upper-right corner of +the window to open the Configure Analytics window. + +**Step 3 –** Add or remove the RIDs of the groups you want to monitor on the Settings tab. See the +[Forged PAC Analytic Type](/docs/threatprevention/8.1/admin/analytics/forgedpac.md) topic for additional information. + +**Step 4 –** On the Policy tab, configure the following: + +- General Tab – Use the toggle to **Enable** the policy +- Event Type Tab – Keep the default settings or set as desired for the Authentication event filters +- Actions Tab – Select **Send to Threat Manager** + +**Step 5 –** Click **Save** after you set the configurations. The Configure Analytics window closes. + +**Step 6 –** In Threat Prevention, click **Configuration** > **Netwrix Threat Manager +Configuration** on the menu. The Netwrix Threat Manager Configuration window opens. + +![Netwrix Threat Manager Configuration Window - Forged PAC tab](/images/threatprevention/8.1/admin/configuration/forgedpac.webp) + +**Step 7 –** Ensure the Event Sink tab is properly set up to send event data to Threat Manager. + +**Step 8 –** On the Forged PAC tab, select the **Include Forged PAC information in events** +checkbox. Click **Save**. + +When a Forged PAC analytic triggers in Threat Prevention, Threat Prevention sends the event data to +Threat Manager. diff --git a/docs/threatprevention/8.1/admin/configuration/trusteddomainsblacklist.md b/docs/threatprevention/8.1/admin/configuration/trusteddomainsblacklist.md new file mode 100644 index 0000000000..8e5ad58101 --- /dev/null +++ b/docs/threatprevention/8.1/admin/configuration/trusteddomainsblacklist.md @@ -0,0 +1,86 @@ +--- +title: "Trusted Domains Blacklist Window" +description: "Exclude unreachable trusted domains from the LDAP queries the Agent uses to resolve accounts" +sidebar_position: 100 +--- + +# Trusted Domains Blacklist Window + +To fill in the account details on an event, the Agent resolves distinguished names, security +identifiers (SIDs), and service principal names (SPNs) over LDAP. It doesn't know in advance which +domain holds a given account, so it queries every domain the monitored domain trusts, until one +answers. + +When the Agent can't reach one of those trusted domains, each query to it has to time out before the +Agent moves on. A domain isolated in a perimeter network, or a cross-forest trust the domain +controller has no route to, can hold up a single lookup for a minute or more. Under a steady flow of +events, the lookups fall behind, the Agent's event queue fills, and the Agent reports that it lost +events. + +The Trusted Domains Blacklist lists the domains the Agent must never query. The Agent skips a domain +on the list rather than querying it, so account resolution no longer waits for it. You set the list +per monitored domain, because a domain that is unreachable from one domain controller may be +perfectly reachable from another. + +:::note +Blacklisting a domain means the Agent can't resolve accounts that live in it. The Agent +still captures events involving those accounts, but the account details on them may be incomplete. +Blacklist only the domains that don't answer. +::: + +## Configure the Blacklist + +To blacklist a trusted domain: + +**Step 1 –** Click **Configuration** > **Trusted Domains Blacklist** on the menu to open the Trusted +Domains Blacklist window. + +![Trusted Domains Blacklist window](/images/threatprevention/8.1/admin/configuration/trusteddomainsblacklist.webp) + +The window holds one row per source domain, with the following columns: + +- Source Domain – The NetBIOS name of the monitored domain the row applies to, for example + `NWXTECH`. Enter an asterisk (`*`) to apply the row to every Agent. +- Excluded Domains (semicolon-separated) – The DNS names of the domains the Agent must never query, + separated by semicolons, for example `dmz.example.com;partner.example.net`. + +**Step 2 –** Click **Add Row** to add an empty row, and then enter the source domain and the excluded +domains. + +To pick the excluded domains from the trusts an Agent reports rather than typing their names, click +**Add from Agent…** instead. + +![Select Trusted Domains window](/images/threatprevention/8.1/admin/configuration/trusteddomainsblacklist_selecttrusts.webp) + +- Select the Agent in the **Agent (DC)** list and click **Connect** to retrieve the domains it + trusts. The list shows each one with its NetBIOS name and its DNS name. +- Check the domains to exclude, or use **Select All** and **Unselect All**, and then click **OK**. + Threat Prevention adds those domains as the excluded domains for that Agent's source domain. + +**Step 3 –** To remove a row, select it and click **Delete**. + +**Step 4 –** Click **OK**. + +The Enterprise Manager sends the updated list to the Agents. You don't need to restart the Agents. + +:::warning +The Enterprise Manager delivers the blacklist to the Agents, so both must run +version 8.1 or later. Upgrade the Enterprise Manager, Administration Console, and Agents together. +See the [Upgrade Procedure](/docs/threatprevention/8.1/install/upgrade/overview.md) topic for +additional information. +::: + +## Confirm That a Domain Is the Cause + +Before blacklisting a domain, confirm it's the one holding up resolution. Enable debug logging for +account resolution on the Agent and look for directory searches that take tens of seconds against a +single domain, or that fail reporting that the server isn't operational. See the +[Log Files and Logging Configuration](/docs/threatprevention/8.1/troubleshooting/logging.md) topic +for additional information. + +After you blacklist the domain, the Agent records each skipped domain in its log at the debug +level. + +See the +[Event Filtering Configuration Window](/docs/threatprevention/8.1/admin/configuration/eventfilteringconfiguration.md) +topic for additional information on reducing the volume of events an Agent processes. diff --git a/docs/threatprevention/8.1/admin/configuration/userroles/_category_.json b/docs/threatprevention/8.1/admin/configuration/userroles/_category_.json new file mode 100644 index 0000000000..a7be09bb41 --- /dev/null +++ b/docs/threatprevention/8.1/admin/configuration/userroles/_category_.json @@ -0,0 +1,10 @@ +{ + "label": "Users and Roles Window", + "position": 110, + "collapsed": true, + "collapsible": true, + "link": { + "type": "doc", + "id": "overview" + } +} \ No newline at end of file diff --git a/docs/threatprevention/8.1/admin/configuration/userroles/add.md b/docs/threatprevention/8.1/admin/configuration/userroles/add.md new file mode 100644 index 0000000000..cdf2c55849 --- /dev/null +++ b/docs/threatprevention/8.1/admin/configuration/userroles/add.md @@ -0,0 +1,41 @@ +--- +title: "Add Users" +description: "Add Users" +sidebar_position: 10 +--- + +# Add Users + +To add a user and assign access rights: + +![Add User button on the Users and Groups window](/images/threatprevention/8.1/admin/configuration/userroles/addbutton.webp) + +**Step 1 –** Click **Configuration** > **Users** on the menu to open the Users and Roles window. + +**Step 2 –** Click the **Add** (+) button in the upper-right corner; the Select Users or Groups +window opens. + +![Select Users or Groups window](/images/threatprevention/8.1/admin/configuration/userroles/selectusersorgroups.webp) + +**Step 3 –** Enter the name of the user you want in the Enter the object names to select box and +click Check Name. On the next window, select the required Active Directory user and click **OK**. +Click **OK** on the Select Users or Groups window to close it. Threat Prevention adds the user to +the Windows User or Group list. + +**Step 4 –** The bottom of the Users and Roles window displays the Administrator and Console +Operator user roles. Select the checkbox for a role to assign it to the user. Checking +Administrator automatically checks the Console Operator role. + +:::tip +The Report User role was a legacy role for the IIS-based SI Reporting Console and doesn't +apply to the Netwrix Threat Manager Reporting Module console. See the +[User Access Page](/docs/threatprevention/8.1/reportingmodule/configuration/systemsettings/useraccess.md) topic for +information on granting report access. +::: + + +**Step 5 –** _(Optional)_ Create as many users as required before clicking OK. + +**Step 6 –** Click **OK** to save changes on the Users and Roles window. + +Users now have the appropriate access rights. diff --git a/docs/threatprevention/8.1/admin/configuration/userroles/delete.md b/docs/threatprevention/8.1/admin/configuration/userroles/delete.md new file mode 100644 index 0000000000..52b7838525 --- /dev/null +++ b/docs/threatprevention/8.1/admin/configuration/userroles/delete.md @@ -0,0 +1,25 @@ +--- +title: "Delete User" +description: "Delete User" +sidebar_position: 30 +--- + +# Delete User + +The Administration Console prevents you from deleting the last user with Administrator rights. There +must always be at least one active administrator. + +To delete a user: + +**Step 1 –** Click **Configuration** > **Users** on the menu to open the Users and Roles window. + +![Remove User button on the Users and Groups window](/images/threatprevention/8.1/admin/configuration/userroles/removeuser.webp) + +**Step 2 –** Select a user and click the **Remove** (x) button in the upper-right corner to delete +it. + +**Step 3 –** _(Optional)_ Delete as many users as you need before clicking OK. + +**Step 4 –** Click **OK** to save changes on this window. + +The deleted users have no access to the Administration Console. diff --git a/docs/threatprevention/8.1/admin/configuration/userroles/modify.md b/docs/threatprevention/8.1/admin/configuration/userroles/modify.md new file mode 100644 index 0000000000..a50f33a1fe --- /dev/null +++ b/docs/threatprevention/8.1/admin/configuration/userroles/modify.md @@ -0,0 +1,28 @@ +--- +title: "Modify User Access" +description: "Modify User Access" +sidebar_position: 20 +--- + +# Modify User Access + +To modify a user’s assigned rights: + +**Step 1 –** Click **Configuration** > **Users** on the menu to open the Users and Roles window. + +![Users and Roles window](/images/threatprevention/8.1/admin/configuration/userroles/usersroleswindow.webp) + +**Step 2 –** Select a user to modify its assigned rights. + +- If the user is an administrator, you can deselect the Administrator checkbox and select the + Console Operator checkbox to downgrade the role. +- If the user is a Console Operator, select the Administrator checkbox to assign a higher + role to it. +- To manage some permissions for the Administrator role, see the + [Administrator Permissions](/docs/threatprevention/8.1/admin/configuration/userroles/overview.md#administrator-permissions) topic. + +**Step 3 –** _(Optional)_ Repeat this action for as many roles as required before clicking OK. + +**Step 4 –** Click OK to save changes on the Users and Roles window. + +Users now have the appropriate access rights updated. diff --git a/docs/threatprevention/8.1/admin/configuration/userroles/overview.md b/docs/threatprevention/8.1/admin/configuration/userroles/overview.md new file mode 100644 index 0000000000..6c468d6066 --- /dev/null +++ b/docs/threatprevention/8.1/admin/configuration/userroles/overview.md @@ -0,0 +1,93 @@ +--- +title: "Users and Roles Window" +description: "Users and Roles Window" +sidebar_position: 110 +--- + +# Users and Roles Window + +On the Users and Roles window, you can grant role based access to users on the Administration +Console. See the +[User Access Page](/docs/threatprevention/8.1/reportingmodule/configuration/systemsettings/useraccess.md) topic for +information on granting access to the Netwrix Threat Manager Reporting Module console. + +Click **Configuration** > **Users** on the menu to open the Users and Roles window. + +![Users and Roles window](/images/threatprevention/8.1/admin/configuration/userroles/usersroleswindow.webp) + +:::note +This window is only available to Threat Prevention administrators. +::: + + +Threat Prevention automatically assigns the administrator role to the user account that ran the +installation. This is the only active user until you add more. This ensures that no unauthorized accounts can open the +Administration Console. + +## Roles + +You can apply two roles to a Threat Prevention user: + +- Administrator – Full access to the Administration Console, though you can restrict access. See + the Administrator Permissions topic for additional information. +- Console Operator – Can create and run policies, and view event data. + +:::note +The Report User role was a legacy feature for the IIS-based Reporting Console and is no +longer applicable. See the [Reporting Module](/docs/threatprevention/8.1/reportingmodule/overview.md) topic for +information on the new reporting console. +::: + + +**Administration Console Rights** + +| | Administrator | Console Operator | +| ----------------------------------------------------------- | ------------------------------- | ------------------------------- | +| Log into the Administration Console | Yes | Yes | +| Create Policies and Policy Templates | Yes | Yes | +| View, Edit, or Delete Unprotected Policies | Yes | Yes | +| View, Edit, or Delete Protected Policies | According to Folder Permissions | According to Folder Permissions | +| Protect Policies at the Folder | Yes | Yes | +| Change Protected Folder Permissions | Yes\* | No | +| Set or Modify Administration Console Configuration Settings | Yes | No | +| Deploy and Manage Agent | Yes | No | +| Add or Remove Users | Yes | No | +| Modify User Access Rights | Yes | No | +| LDAP Operations Center | Yes | No | + +\*If an administrator changes permissions on protected policies they don't own, Threat Prevention +generates a system alert. + +See the [Policies Interface](/docs/threatprevention/8.1/admin/policies/overview.md) topic for information on protected and +unprotected policies. + +A user must have the following minimum permissions on the SQL Server databases, both the +NVMonitorConfig and NVMonitorData databases, according to the assigned role: + +- Administrator Role + + - Read/Write data + - If using the [Database Maintenance Window](/docs/threatprevention/8.1/admin/configuration/databasemaintenance/overview.md) – You need SQL + Admin (sa) rights + +- Console Operator Role + + - Read/Write data + +## Administrator Permissions + +The Features button is enabled for users with the Administrator role. It provides options to limit +Administrator permissions to manage features, stop the Agent, or uninstall the Agent. + +![Users and Roles window showing the Edit Features window](/images/threatprevention/8.1/admin/configuration/userroles/featuresbutton.webp) + +To edit the features for the selected user, use the following steps. All listed features are enabled +by default. + +**Step 1 –** Click the **Features** button. The Edit features window opens. + +**Step 2 –** Check and uncheck features as needed. + +**Step 3 –** Click **OK**. + +The user has no rights to the deselected features. diff --git a/docs/threatprevention/8.1/admin/investigate/_category_.json b/docs/threatprevention/8.1/admin/investigate/_category_.json new file mode 100644 index 0000000000..e26c62f1a0 --- /dev/null +++ b/docs/threatprevention/8.1/admin/investigate/_category_.json @@ -0,0 +1,10 @@ +{ + "label": "Investigate Interface", + "position": 60, + "collapsed": true, + "collapsible": true, + "link": { + "type": "doc", + "id": "overview" + } +} \ No newline at end of file diff --git a/docs/threatprevention/8.1/admin/investigate/datagrid.md b/docs/threatprevention/8.1/admin/investigate/datagrid.md new file mode 100644 index 0000000000..6aff85583c --- /dev/null +++ b/docs/threatprevention/8.1/admin/investigate/datagrid.md @@ -0,0 +1,127 @@ +--- +title: "Investigate Data Grid" +description: "Investigate Data Grid" +sidebar_position: 30 +--- + +# Investigate Data Grid + +The data grid on the Investigate interface displays events. + +To view events in the data grid: + +**Step 1 –** Click **Investigate** in the left pane to launch the Investigate interface. + +**Step 2 –** To expand the grid view, do either of the following: + +- Collapse the individual filter category sections +- Use the arrow between the filter categories and the grid view to collapse the entire filter + category section + +![Investigate interface - Data Grid](/images/threatprevention/8.1/admin/investigate/datagrid.webp) + +**Step 3 –** Select the **Production** or **Archive** option button to view events from the +respective database. + +The archive database is part of the Threat Prevention Database Maintenance feature, and you can only +query it from the Administration Console. See the +[Archive Data](/docs/threatprevention/8.1/admin/configuration/databasemaintenance/archive.md) topic for additional information. + +**Step 4 –** Use the **Get Top [number] Events** box to specify the number of events to +display. + +**Step 5 –** Check the For Each Policy checkbox to view the specified number of events on a per +policy basis. If unchecked, the number of events displayed depends solely on the time +Threat Prevention logged the event. + +**Step 6 –** Use the Refresh button to repopulate the data grid with the current information for the +selected options. + +The Show All Columns link automatically adds any hidden columns to the data grid. + +Each column in the data grid has a prefix identifying the type of information displayed. +Double-click a populated grid column to access the +[Event Viewer Window](/docs/threatprevention/8.1/admin/policies/configuration/recentevents/eventviewer.md) with detailed information on the +event. The columns display the following information for each event: + +- Event: Policy Name – Policy which monitored or blocked the event +- Event: Time Logged – Timestamp for when the event was monitored/blocked. The specified time is the + local time for the server where the Agent is deployed.Hover over the data in this column to view + the local time (of the Enterprise Manager) and UTC time simultaneously. +- Event: UTC Time Logged – UTC Timestamp for when the event was monitored/blocked by the Agent. + Hover over the data in this column to view the local time (of the Enterprise Manager) and UTC time + simultaneously. +- Affected Object: Path – Name of the affected object according to the type of monitoring/blocking + + - Active Directory monitoring/blocking – Active Directory distinguished name for the affected + object + - Effective Group Membership monitoring – Active Directory distinguished name for the affected + group. A double asterisk (\*\*) at the beginning indicates that the path is to the nested + group where the actual membership change occurred. + - Exchange monitoring/blocking – Name of the affected Exchange mailbox + - File System monitoring/blocking – Original path of the affected file or folder + - Authenticate – DN of the user object making the request + + :::note + Threat Prevention doesn't use Affected Object Path for LDAP bind/monitoring/blocking. + ::: + + +- Agent: Domain – Active Directory domain where the Agent that monitored/blocked the event is + deployed +- Affected Object: Class – Active Directory class of the affected object +- Event: Type – Identifies the type of monitoring/blocking, e.g. Active Directory, File System, + Exchange +- Event: Raw Name – Short description of the monitored operation +- Perpetrator: DN – Distinguished name for the perpetrator account +- Agent: Computer – Server where the Agent is deployed +- Agent: IP Address – IP address of the server where the Agent is deployed +- Perpetrator: Access URL – Raw data, the combination of the protocol, IP address, and the Port used + as part of the event + + - Process Guardian monitoring/blocking – Process name that is modifying or attempting to modify + target process + +- Event: Success – Indicates the event completed successfully +- Event: Blocked – Indicates the Agent blocked the event from occurring +- Affected Object SID – Security Identifier of the object/account affected by the event +- Affected Object: Account Name – Security principal of the account affected by the event +- Affected Object GUID – The globally unique identifier of the object affected by the event +- Event: Name – Type of event monitored/blocked +- Perpetrator: Name – Security principal of the account that triggered the event +- Perpetrator: SID – Security Identifier of the account used in the event +- Perpetrator: Protocol – Protocol used for the monitored operation + + - File System monitoring/blocking – Name of the share where the operation was monitored/blocked. + This is blank if the affected host has an operating system older than Windows Server 2008 + R2. + +- Perpetrator: IP Address – IP address of the originating host + + - File System monitoring/blocking – This is blank if the affected host has an operating + system older than Windows Server 2008 R2. + +- Perpetrator: MAC Address – Network adapter identifier +- Perpetrator: Host – Name of the originating host +- Affected Object: IP Address – IP address of the host where the affected object resides +- Affected Object: Host – Name of the host the security principal is trying to access +- Event: Message – Result of the attempted operation +- Event: Count – Number of identical events that occurred in one minute + +Select an event in the data grid to view additional information for it at the bottom of the +Investigate interface. + +![Investigate Interface - Attributes area](/images/threatprevention/8.1/admin/investigate/attributes.webp) + +The interface displays the following information (as applicable to the event): + +- Attribute Name – The name of the object attribute that is affected +- Operation – The operation performed on the attribute +- Old Value – Value before the monitored change +- New Value – Value after the monitored change + +This data grid employs features for sorting, filtering, searching, and more. See the +[ Data Grid Functionality](/docs/threatprevention/8.1/admin/navigation/datagrid.md) topic for additional information. + +To export the data displayed in the grid to a CSV file, see the +[Export Data](/docs/threatprevention/8.1/admin/navigation/datagrid.md#export-data) topic. diff --git a/docs/threatprevention/8.1/admin/investigate/filters.md b/docs/threatprevention/8.1/admin/investigate/filters.md new file mode 100644 index 0000000000..3143e8c0bd --- /dev/null +++ b/docs/threatprevention/8.1/admin/investigate/filters.md @@ -0,0 +1,115 @@ +--- +title: "Investigate Filters" +description: "Investigate Filters" +sidebar_position: 40 +--- + +# Investigate Filters + +On the [Investigate Interface](/docs/threatprevention/8.1/admin/investigate/overview.md), you can apply six filter categories to +the recent events available in the data grid. By default, no filters apply. For the Policy +filter, Threat Prevention selects all enabled unprotected policies and any protected policies the +current user has rights to view, and leaves the other filter categories blank. You can apply filters using any +combination of the filter categories. Use the Refresh button to repopulate the data grid with the +current information for the selected filters. + +![Investigate Interface - Filter Categories](/images/threatprevention/8.1/admin/investigate/filtercategories.webp) + +The following sections describe the filter categories. + +**Policy** + +To filter by Policy, check the checkboxes for each policy you want. Protected policies that the +current user doesn't have rights to view are grayed-out. + +- All policies – Toggles on or off all available policies +- Show Deleted Policies – Displays previously deleted policies in the Policy filter category. The + filter includes them. By default, investigation results don't include event data from deleted + policies. + +**Who** + +To filter by Who, check the Perpetrator box to filter for a particular security principal committing +the change and/or check the Affected Object box to filter for a particular object that a change +affects. + +For the Perpetrator option, select the option button for either: + +- Name – Identify a perpetrator by name +- SID – Identify a perpetrator by the Security Identifier + +Then enter the who in the textbox or use the ellipsis (…) to open the Available Perpetrators window +that displays perpetrators known within the database. + +For the Affected Object option, select the option button for either: + +- DN / File Path – Identify an object by the distinguished name or file path +- Account – Identify an object by the SAM account name +- GUID – Identify an object by the globally unique identifier + +Then enter the who in the textbox. Filter criteria can be a partial match. + +**When** + +Filtering by When provides several options, including the option between using Local Time or UTC +time. + +- To filter from a specified date and time to the present, check the Between box and set the start + time and date +- To filter for everything before a specified date time, check the And box and set the end time and + date +- To filter for a specific time frame, check both the Between and And boxes, then set the start and + end times +- To filter for Events for Last [number] Hours, check this box and set the number of hours to use + as the filter + +**Where** + +To filter by Where, check the box(es) for the filter types you want: + +- In this Domain – Enter the [domain name] in the textbox or use the ellipsis (…) to open the + Available Domains window that displays domains known within the database. +- Detected on Server – Select the radio button for either Name or IP and then enter the server in + the textbox. Use the ellipsis (…) to open the Available Servers window that displays + servers known within the database. +- From This Computer – Select the radio button for either Name or IP and then enter the computer in + the textbox +- To This Computer – Select the radio button for either Name or IP and then enter the computer in + the textbox + +**Filter criteria can be a partial match** + +What + +To filter by What, check the box(es) for the filter types you want: + +- Event – Select the option button for either Success or Fail +- Action Type – Select the option button for either Blocked or Not Blocked + +**Other** + +To filter by Other, check the box(es) for the filter types you want: + +- Class +- Perpetrator Protocol +- Event Source +- Event Name +- Attribute Name +- Attribute Value – Select the option button for either Oldor New and then enter the old or new + value in the box + +Filter criteria can be a partial match. + +:::warning +The Full Text Search doesn't use indexes. Unless you select other indexed criteria, the +full text search can scan the entire SQL database, which can be very slow for large databases. +::: + + +- Full Text Search – Queries the entire SQL database for the entered attribute. If the attribute + appears anywhere in the event, the data grid displays it. + +Click the arrow on the filter category header ribbon to expand or collapse the category. You can +also clear all filters by clicking the Reset Filters button on the ribbon between the filter +categories and the data grid. You can also save filtered views. See the +[Saved Investigations](/docs/threatprevention/8.1/admin/investigate/saved.md) topic for additional information. diff --git a/docs/threatprevention/8.1/admin/investigate/overview.md b/docs/threatprevention/8.1/admin/investigate/overview.md new file mode 100644 index 0000000000..a457cc87a4 --- /dev/null +++ b/docs/threatprevention/8.1/admin/investigate/overview.md @@ -0,0 +1,26 @@ +--- +title: "Investigate Interface" +description: "Investigate Interface" +sidebar_position: 60 +--- + +# Investigate Interface + +Use the Investigate interface to view recent events in a centralized location. You +can investigate either Production events or Archive events. Any protection applied at the Policy +folder level limits the data. See the [Policies Interface](/docs/threatprevention/8.1/admin/policies/overview.md) topic for +additional information on the protection feature. + +Click **Investigate** in the left pane to launch the Investigate interface. + +![Investigate Interface](/images/threatprevention/8.1/admin/investigate/investigateinterface.webp) + +Next to the Investigate title, use the dropdown menu to select LDAP Policies or All Other Policies +to show in the data grid. Select the Show Deleted Policies checkbox to view deleted policies +too. + +The top section of the window provides filtering options. See the [Investigate Filters](/docs/threatprevention/8.1/admin/investigate/filters.md) +topic for additional information. The bottom section displays the recent events. + +For an understanding of the data displayed in the grid, see the [Investigate Data Grid](/docs/threatprevention/8.1/admin/investigate/datagrid.md) +topic. diff --git a/docs/threatprevention/8.1/admin/investigate/saved.md b/docs/threatprevention/8.1/admin/investigate/saved.md new file mode 100644 index 0000000000..ab4a15c451 --- /dev/null +++ b/docs/threatprevention/8.1/admin/investigate/saved.md @@ -0,0 +1,26 @@ +--- +title: "Saved Investigations" +description: "Saved Investigations" +sidebar_position: 10 +--- + +# Saved Investigations + +You can apply filters on the [Investigate Interface](/docs/threatprevention/8.1/admin/investigate/overview.md) to filter event data. +You can also save filter settings. To save a filtered view: + +![Investigate Interface - Save a Filtered View](/images/threatprevention/8.1/admin/investigate/saveview.webp) + +**Step 1 –** Click **Investigate** in the left pane to launch the Investigate interface. + +**Step 2 –** Set the filter [1], refresh the data grid [2], and click **Save Filter +Settings and Layout** [3]. The Filter Set Name window opens. + +![Filter Set Name window](/images/threatprevention/8.1/admin/investigate/filtersetname.webp) + +**Step 3 –** Enter a name for this filtered view and click **OK**. + +![Saved filter view in the navigation pane](/images/threatprevention/8.1/admin/investigate/savedview.webp) + +The saved filtered view becomes a node in the Navigation pane under the Investigate node. Select the +node to return to the saved filtered Investigate view. diff --git a/docs/threatprevention/8.1/admin/investigate/summaryfolders.md b/docs/threatprevention/8.1/admin/investigate/summaryfolders.md new file mode 100644 index 0000000000..2fd3d539d1 --- /dev/null +++ b/docs/threatprevention/8.1/admin/investigate/summaryfolders.md @@ -0,0 +1,67 @@ +--- +title: "Summary Folders" +description: "Summary Folders" +sidebar_position: 20 +--- + +# Summary Folders + +The EPE Summary and LDAP Summary folders under Investigate in the navigation pane are pre-defined +reports that show consolidated recent event activity for EPE or LDAP that spans all +EPE or LDAP policies. The reports include default groupings that best show the consolidated data. + +![EPE Summary and LDAP Summary folders](/images/threatprevention/8.1/admin/investigate/summaryfolders.webp) + +The investigate summary folders have the following reports: + +- EPE Summary + - Last 10,000 Failed passwords by Policy and Rule + - Number of Failed passwords by Policy Name + - Number of Failed passwords by Rule Name + - Number of Failed passwords by Policy and Rule +- LDAP Summary + - Top 10,000 Most frequently run queries by User Accounts + - Top 10,000 Most frequently run queries by Computer Accounts + - Top 10,000 Most frequently run queries by IP + - Most frequently run queries by Account for TOP 5 User Accounts + - Most frequently run queries by Account for TOP 5 Computer Accounts + - Most frequently run queries by IP for TOP 5 IPs + - Run Time by Account + - Run Time by IP + - Run Time by Domain Controller + - Number of Searches by Domain Controller + +Click a report to view it. + +![Summary Report](/images/threatprevention/8.1/admin/investigate/summaryreport.webp) + +By default, the data grid is blank. Select **Refresh** to display results on the data grid. + +The grid view displays columns associated with the scope of the report. If there is no data +available, the grid doesn't populate but the columns display on the grid. The following buttons are +available below the report name: + +- Refresh – Repopulates the data grid with the current information for the selected report +- Configure – Opens the Parameters window. Set the optional time range as well as the type of + policies. +- Export – Export the selected report to an Excel, PDF, HTML, RTF, or CSV output. The Save As window + displays when you select an export option. Provide a name for the report and save it to a + specified location. + +**Parameter Window** + +![Parameter Window](/images/threatprevention/8.1/admin/investigate/parameter.webp) + +The Parameters window displays the following options. Select the options you want and click **OK** to +display data in the report accordingly. + +- Range From/To –If left unchecked, the report displays all policy data. When enabled, set a date + range for the data to display in the report using the To and From dropdown calendars. By + default, the calendar displays today's date. Click **OK** to set the date and time. + + For faster navigation on the calendar, select the month to display all twelve months to choose + from. Once showing the months, select the year to display a range of years to choose from. + +- Policies – Choose **All** or **Enabled Only** to display all policies or enabled only policies in + the report +- Events – Select **All**, **Blocking**, and/or **Monitoring** events to display in the report diff --git a/docs/threatprevention/8.1/admin/navigation/_category_.json b/docs/threatprevention/8.1/admin/navigation/_category_.json new file mode 100644 index 0000000000..4ee7155632 --- /dev/null +++ b/docs/threatprevention/8.1/admin/navigation/_category_.json @@ -0,0 +1,10 @@ +{ + "label": "Navigation", + "position": 10, + "collapsed": true, + "collapsible": true, + "link": { + "type": "doc", + "id": "overview" + } +} \ No newline at end of file diff --git a/docs/threatprevention/8.1/admin/navigation/datagrid.md b/docs/threatprevention/8.1/admin/navigation/datagrid.md new file mode 100644 index 0000000000..3412847f3c --- /dev/null +++ b/docs/threatprevention/8.1/admin/navigation/datagrid.md @@ -0,0 +1,170 @@ +--- +title: "Data Grid Functionality" +description: "Data Grid Functionality" +sidebar_position: 20 +--- + +# Data Grid Functionality + +Several interfaces in the Administration Console display result data using data grids. These +grids employ features for data sorting, filtering, searching, and more. + +![Data Grid Functionality pointers](/images/threatprevention/8.1/admin/navigation/datagridfunctionality.webp) + +- The Group by Box [1] ribbon affects how much data the grid displays. See the Sort Data topic for + additional information. +- The Refresh [2] button populates the data grid with the current information according to the + selections. +- You can reorder columns and remove them from the data grid. You can add removed columns back + through the Customization Window. +- Many data grids also contain an Export Data [3] button. This provides different export options + with respect to the interface. See the Export Data topic for additional information. +- The Search [4] icon opens the **Enter text to search…** textbox where you can search for the + required data in the data grid. See the Search Data topic for additional information. +- The Auto Filter row [5] uses comparison operators to filter the grid against a single attribute. + See the Filter Data topic for additional information. + +## Customization Window + +Right-click a column header and select **Column Chooser** to open the Customization window, which +lists the columns you removed from the data grid display. + +![Customization Window](/images/threatprevention/8.1/admin/navigation/customization.webp) + +You can remove a column from the data grid in any of these ways: + +- Drag the column and drop it into this window +- Right click in a column header and select **Hide This Column** + +You can return a column to the data grid by double-clicking it in the Customization window or by +dragging and dropping it from this window onto the column header row. + +## Sort Data + +You can group data by columns using the Group by Box ribbon above the data grid. + +![Sort Data function in the data grid](/images/threatprevention/8.1/admin/navigation/sortdatafunction.webp) + +Drag a column header into the Group by Box area to group data from that perspective. You can group +by a single header or by tiered headers. + +You can also sort data alphanumerically ascending or descending by clicking a column header. An +arrow displays in the right corner of the column header indicating the type of sorting. + +## Filter Data + +Several methods are available for filtering data in data grids. There can only be one active filter +per column. + +![Filter Data functions in a Data Grid](/images/threatprevention/8.1/admin/navigation/filterdata.webp) + +- Auto Filter Row [A] – Uses the comparison operator to filter the grid against a single attribute +- Filter Statement Bar [B] – Displays enabled filter statements at the bottom of the display area +- Filter Editor [C] – Build complex filter statements with multiple operators and column filters +- Pin Icon [D] – Opens a filtration dialog that provides multiple types of filtration options such + as  column values, text filters, and date filters associated with the column data + +**Auto Filter Row** + +The Auto Filter row is located between the header row and the first event of the data grid. Typing a +single attribute in any of these boxes or selecting an attribute from a dropdown menu filters the +data grid for matches within that column and the selected comparison operator. + +:::note +The Alerts grid doesn't display the Auto Filter Row by default. You must select it +through the grid’s Show Auto Filter Row option on the right-click menu. +::: + + +**Filter Statement Bar** + +When you enable a filter, the filter statement bar displays at the bottom of the display area. +The X to the left of the bar clears the filter. The checkbox for the filter on the left affects the +scoping of the filter. + +**Filter Editor** + +Notice the Edit Filter option on the right side of the filter statement bar. Click it to open the +Filter Editor window, where you can build complex filter statements. It can employ multiple +comparison operators and/or multiple column filters. + +![Filter Editor](/images/threatprevention/8.1/admin/navigation/filtereditor.webp) + +**Pin Icon** + +A small pin icon displays in the upper-right corner when you hover over a column header or when an +Auto Filter Row filter is enabled. + +Click the **pin icon** to open additional filtration options in a filter window. The options +displayed depend on the column it is opened from. + +![Window with filtration options](/images/threatprevention/8.1/admin/navigation/valuesfilter.webp) + +- Values – Displays for every column in the data grid. You can select multiple values. +- Text/Numeric – This is linked to the Auto filter Row filter with the addition of three new + filtration options including a custom filter option +- Date – Calendars with date timestamps display this filter with an array of scoping options + including a custom filter +- Custom Filter – Found within Text filters, this filter creates an AND or OR statement between two + filtered comparison values + +## Search Data + +Use the Find Panel to search for data in the data grid. A magnifying glass icon represents it. It +displays by default, but you can hide or show it using the Show/Hide +Find Panel option on the +[Data Grid Right-Click Menu](/docs/threatprevention/8.1/admin/navigation/rightclickmenus.md#data-grid-right-click-menu). + +When you click the magnifying glass icon, the Find box appears as: + +![Search function for data grid](/images/threatprevention/8.1/admin/navigation/searchfunction.webp) + +- Enter a search criteria and click **Find**. The data grid filters to events that match the search + criteria and highlights the match. +- The dropdown arrow in the textbox provides a history of recent searches for quick reference. +- Click **Clear** to clear both the search criteria and the filtered view. +- The **X** at the far left of the panel closes the Find Panel. + +![Search Results](/images/threatprevention/8.1/admin/navigation/searchresults.webp) + +## Export Data + +The data grids provide an option to export data. + +- Data grids on the Agents interface and on the Analytics windows export all available data from the + grid to a CSV file. Clicking the **Export** button from these interfaces opens a Save As window. +- Clicking the Export button from the Alerts interface opens the Alerts Export window. See the + [Alerts Export Window](/docs/threatprevention/8.1/admin/alerts/alertsexport.md) topic for additional information. +- Clicking the Export button from the Investigate interface or the Recent Events tab of a policy + opens the Export window. + +:::note +Ensure that you set all the filters you need on the data grid before export. +::: + + +![Export window](/images/threatprevention/8.1/admin/navigation/export.webp) + +The Export window provides options for what to export and what actions to take. + +In the Export options section, select the option buttons for the Columns and Rows subsections. + +- For Columns, you can export data displayed in Visible Columns Only or for All Columns. See the + Customization Window topic for details on selecting what columns are visible in a data grid. +- For Rows, the exported data can show All Rows or Filtered Only. + +In the Export Actions section, select where to export the data. Check the boxes for Save File +Locally and/or Email to and populate the required fields. + +- For the Save File Locally action, the Save As window opens when you click Export. Use the + default path and file name to save the CSV file or choose another one. Then click Save. +- For the Email to action, provide an email address for each recipient, which can be individuals, + distribution lists, or a combination. Use either a comma (,) or a semi-colon (;) to separate + multiple recipients. Click Export to export the data. + +:::note +The Email to action requires configured SMTP host information. Only a Threat Prevention +administrator can configure this through the +[Email Tab](/docs/threatprevention/8.1/admin/configuration/systemalerting/email.md) of the System Alerting window. + +::: diff --git a/docs/threatprevention/8.1/admin/navigation/licensemanager.md b/docs/threatprevention/8.1/admin/navigation/licensemanager.md new file mode 100644 index 0000000000..82f208c27c --- /dev/null +++ b/docs/threatprevention/8.1/admin/navigation/licensemanager.md @@ -0,0 +1,147 @@ +--- +title: "License Manager Window" +description: "License Manager Window" +sidebar_position: 30 +--- + +# License Manager Window + +The License Manager window displays the Threat Prevention modules that you are licensed for. If +under an Enterprise license, it also displays an expiration date. On license expiry, the Enterprise +Manager refuses events from all Agents. + +:::tip +If the Administration Console doesn't receive and display events, check whether your +license has expired. +::: + + +**Generate Alerts when the License Nears Expiration** + +You can configure Threat Prevention to send alerts when the license nears expiration. These +alerts serve as a reminder for license renewal. + +To generate license expiration alerts 14 days before license expiry, enable the **License** option +on the [System Alerting Window](/docs/threatprevention/8.1/admin/configuration/systemalerting/overview.md). Go to the Email, Event +Log or SIEM tab depending on how you want to receive alerts (i.e., by email, in the Windows event +log, or in a SIEM product) and click Configuration in the left pane to locate the License option for +enabling it. + +Threat Prevention generates the first alert 14 days before license expiry and then generates one +every following day at 9:00 AM. You can customize the time by modifying the following entry in the +SIEnterpriseManager.exe.config file: + +**** + +File path: `...\Netwrix\Netwrix Threat Prevention\SIEnterpriseManager` + +## View Licensing Information + +To view your Threat Prevention license details: + +Click **Help > License Manager** on the menu. The Netwrix Threat Prevention License Manager window +opens. + +![License Manager window](/images/threatprevention/8.1/admin/navigation/licensemanager.webp) + +This window lists the modules that you are licensed for. Each module links to a Threat +Prevention solution. + +Following is a list of the solutions with their respective modules. You can also view the event +types available with each module. + +:::note +The Password Enforcement module is available under all licenses for monitoring weak +passwords. However, you need the Enterprise Password Enforcer solution license to block weak +passwords. +::: + + +#### Active Directory Solution + +The Active Directory solution comes with the following licensed modules: + +| Licensed Module | Available Event Type | +| -------------------------- | ------------------------------ | +| Active Directory Changes | Active Directory Changes
Active Directory Read Monitoring
AD Replication Monitoring
Authentication Monitoring
Effective Group Membership
FSMO Role Monitoring
Process Guardian – Monitor | +| Active Directory Lockdown
\*Requires Active Directory Changes Module | Active Directory Lockdown
AD Replication Lockdown
Authentication Lockdown
Process Guardian – Protect | +| GPO Lockdown
\*Requires Active Directory Changes Module
\*\*Requires File System Module | GPO Setting Lockdown | +| GPO Setting Changes
\*Requires Active Directory Changes Module
\*\*Requires File System Module | GPO Setting Changes | + +See the following topics for additional information: + +- [Active Directory Changes Event Type](/docs/threatprevention/8.1/admin/policies/configuration/eventtype/activedirectorychanges.md) +- [Active Directory Lockdown Event Type](/docs/threatprevention/8.1/admin/policies/configuration/eventtype/activedirectorylockdown.md) +- [Active Directory Read Monitoring Event Type](/docs/threatprevention/8.1/admin/policies/configuration/eventtype/activedirectoryreadmonitoring.md) +- [AD Replication Monitoring Event Type](/docs/threatprevention/8.1/admin/policies/configuration/eventtype/adreplicationmonitoring.md) +- [AD Replication Lockdown Event Type](/docs/threatprevention/8.1/admin/policies/configuration/eventtype/adreplicationlockdown.md) +- [Authentication Monitoring Event Type](/docs/threatprevention/8.1/admin/policies/configuration/eventtype/authenticationmonitoring.md) +- [Authentication Lockdown Event Type](/docs/threatprevention/8.1/admin/policies/configuration/eventtype/authenticationlockdown.md) +- [Effective Group Membership Event Type](/docs/threatprevention/8.1/admin/policies/configuration/eventtype/effectivegroupmembership.md) +- [FSMO Role Monitoring Event Type](/docs/threatprevention/8.1/admin/policies/configuration/eventtype/fsmorolemonitoring.md) +- [GPO Setting Changes Event Type](/docs/threatprevention/8.1/admin/policies/configuration/eventtype/gposettingchanges.md) +- [GPO Setting Lockdown Event Type](/docs/threatprevention/8.1/admin/policies/configuration/eventtype/gposettinglockdown.md) +- [Process Guardian – Monitor Event Type](/docs/threatprevention/8.1/admin/policies/configuration/eventtype/lsassguardianmonitor.md) +- [Process Guardian – Protect Event Type](/docs/threatprevention/8.1/admin/policies/configuration/eventtype/lsassguardianprotect.md) + +#### Enterprise Password Enforcer Solution + +The Enterprise Password Enforcer solution comes with the following licensed modules: + +| Licensed Module | Available Event Type | +| --------------------------- | -------------------- | +| Password Enforcement Module | Password Enforcement | + +See the [Password Enforcement Event Type](/docs/threatprevention/8.1/admin/policies/configuration/eventtype/passwordenforcement/passwordenforcement.md) topics for +additional information. + +#### Exchange Solution + +The Exchange solution comes with the following licensed modules: + +| Licensed Module | Available Event Type | +| ---------------------------------------------------------- | -------------------- | +| Exchange Events Module | Exchange Changes | +| Exchange Lockdown Module
\*Requires Exchange Events Module | Exchange Lockdown | + +See the following topics for additional information: + +- [Exchange Changes Event Type](/docs/threatprevention/8.1/admin/policies/configuration/eventtype/exchangechanges.md) +- [Exchange Lockdown Event Type](/docs/threatprevention/8.1/admin/policies/configuration/eventtype/exchangelockdown.md) + +#### File System Solution + +The File System solution comes with the following licensed modules: + +| Licensed Module | Available Event Type | +| ------------------ | --------------------------- | +| File System Module | File System Changes
File System Lockdown
File System Enterprise Auditor | + +The File System Changes event type and File System Lockdown event type only generate event +monitoring and blocking data for Threat Prevention. The File System Enterprise Auditor event type +only generates event monitoring data for Netwrix Access Analyzer (formerly Enterprise Auditor). To +make the same data accessible to both products, create a single policy with both +event types assigned. + +See the following topics for additional information: + +- [File System Changes Event Type](/docs/threatprevention/8.1/admin/policies/configuration/eventtype/filesystemchanges/filesystemchanges.md) – For Windows file + servers and/or NAS devices +- [File System Lockdown Event Type](/docs/threatprevention/8.1/admin/policies/configuration/eventtype/filesystemlockdown.md) – For Windows file + servers +- [File System Enterprise Auditor Event Type](/docs/threatprevention/8.1/admin/policies/configuration/eventtype/filesystemaccessanalyzer.md) + – For Windows file servers + +#### LDAP Solution + +The LDAP solution comes with the following licensed modules: + +| Licensed Module | Available Event Type | +| -------- | ------------ | +| LDAP Monitoring Module
\*Requires Active Directory Changes Module | LDAP Lockdown
LDAP Monitoring
LDAP Bind Monitoring | + +See the following topics for additional information: + +- [LDAP Monitoring Event Type](/docs/threatprevention/8.1/admin/policies/configuration/eventtype/ldapmonitoring/ldapmonitoring.md) +- [LDAP Lockdown Event Type](/docs/threatprevention/8.1/admin/policies/configuration/eventtype/ldaplockdown.md) +- [LDAP Bind Monitoring Event Type](/docs/threatprevention/8.1/admin/policies/configuration/eventtype/ldapbindmonitoring.md) diff --git a/docs/threatprevention/8.1/admin/navigation/overview.md b/docs/threatprevention/8.1/admin/navigation/overview.md new file mode 100644 index 0000000000..4cc80fec51 --- /dev/null +++ b/docs/threatprevention/8.1/admin/navigation/overview.md @@ -0,0 +1,150 @@ +--- +title: "Navigation" +description: "Navigation" +sidebar_position: 10 +--- + +# Navigation + +Use the Threat Prevention Administration Console to: + +- Create and configure policies and policy templates +- Configure analytics +- Deploy and manage Agents +- Import and export Threat Prevention policies and policy templates +- Configure alerts + +Policies control the real-time event monitoring/blocking of files and directories, users, groups, +Active Directory objects, and Microsoft Exchange objects. These policies enable Threat Prevention to +detect and report changes as well as send notification when changes occur. + +## Administration Console Components + +The Administration Console has the following components: + +- Menu +- Policy Center +- Status Bar + +![Threat Prevention Administration Console – Components](/images/threatprevention/8.1/admin/navigation/adminconsole.webp) + +There are also right-click commands available within different sections of the Policy Center. + +If the Administration Console user interface or windows don't display properly, see the +[Troubleshooting FAQs](/docs/threatprevention/8.1/troubleshooting/overview.md#troubleshooting-faqs) topic for +information. + +## Menu + +The Menu contains the following selections: + +![Administration Console - Menu](/images/threatprevention/8.1/admin/navigation/menu.webp) + +| Menu Item | Option | Description | +| ------------- | ------------------- | ------------------- | +| File | New | Create new policies (Ctrl+P), new templates (Ctrl+T), or new folders (Ctrl+F) in the selected location of the Policy Center | +| | Rename | Opens a textbox to rename the selected policy, template, or folder in the Policy Center | +| | Remove | Removes the selected policy, template, or folder from the Policy Center | +| | Exit | Exit the Administration Console | +| Tools | Export … | Export (Alt+X) policies and templates through the [Export Policies and Templates Window](/docs/threatprevention/8.1/admin/tools/exportpoliciestemplates.md) | +| | Import … | Import (Alt+I) policies/templates, collections, and event consumers/alerts from an exported file through the [Import Window](/docs/threatprevention/8.1/admin/tools/import.md) | +| Configuration | Alerts | Configure and manage all email, event log, and SEIM alerts in the [System Alerting Window](/docs/threatprevention/8.1/admin/configuration/systemalerting/overview.md) | +| | Users | A security feature for configuring access to the Administration Console. You add users and assign them rights through the [Users and Roles Window](/docs/threatprevention/8.1/admin/configuration/userroles/overview.md). | +| | Database > Server | Manage the events database in the [Events Database Configuration Window](/docs/threatprevention/8.1/admin/configuration/eventsdatabaseconfiguration.md). You can view the information, but can't make changes. | +| | Database > Maintenance | Use database maintenance to automatically groom the database to optimize performance by archiving and/or deleting data aged beyond a specified threshold. You can configure it to run by Event Type, Analytic, or Policy in the [Database Maintenance Window](/docs/threatprevention/8.1/admin/configuration/databasemaintenance/overview.md). | +| | Collections | Manage all Microsoft Collections in the [Collection Manager Window](/docs/threatprevention/8.1/admin/configuration/collectionmanager/overview.md) | +| | Event Filtering | Filters Active Directory events to remove “noise” from collected event data and/or exclude logins from machine accounts. Both settings are ON by default. It also lets you exclude authentication events from selected hosts or accounts; these options require configuration before you can enable them. You can set a latency threshold to generate alerts when the delivery of AD Events is delayed beyond the threshold. You configure these options in the [Event Filtering Configuration Window](/docs/threatprevention/8.1/admin/configuration/eventfilteringconfiguration.md). | +| | Netwrix Threat Manager Configuration | Enables integration between Threat Prevention and Threat Manager in a global setting. You set the Threat Manager URI in the [Netwrix Threat Manager Configuration Window](/docs/threatprevention/8.1/admin/configuration/threatmanagerconfiguration.md). Choose policies through the Policy checkboxes in this window or the Actions tab of each policy for sending event data to Threat Manager. | +| | File Monitor Settings | Manages the log retention, inherited permissions filtering, disables office file filtering, and the ability to exclude AD accounts and processes for Threat Prevention file monitoring and blocking policies in a global setting. You set these options in the [File Monitor Settings Window](/docs/threatprevention/8.1/admin/configuration/filemonitorsettings.md). | +| | EPE Settings | Manages the Have I Been Pwned password hash database configuration and update options as well as global Password Rules filter configurations. You configure these options in the [EPE Settings Window](/docs/threatprevention/8.1/admin/configuration/epesettings.md). | +| Help | Administration Console Help | Opens the internal help documentation | +| | License Manager | Opens the Threat Prevention [License Manager Window](/docs/threatprevention/8.1/admin/navigation/licensemanager.md), which displays the customer name, license expiry date, and licensed modules | +| | About Netwrix Threat Prevention Administration Console | Opens the Administration Console window, which displays the product version, copyright, and the Netwrix website link | + +## Policy Center + +The Policy Center is the primary interface of the Administration Console. It has two +sections: the Navigation pane and the Display area. + +![Administration Console – Policy Center](/images/threatprevention/8.1/admin/navigation/policycenter.webp) + +The Navigation pane provides interface options while the Display area displays the selected +interface. The following interface options are available: + +- [Agents Interface](/docs/threatprevention/8.1/admin/agents/overview.md) +- [Alerts Interface](/docs/threatprevention/8.1/admin/alerts/overview.md) +- [Investigate Interface](/docs/threatprevention/8.1/admin/investigate/overview.md) +- [Analytics Interface](/docs/threatprevention/8.1/admin/analytics/overview.md) +- [Policies Interface](/docs/threatprevention/8.1/admin/policies/overview.md) +- [Templates Interface](/docs/threatprevention/8.1/admin/templates/overview.md) +- [Tags Node](/docs/threatprevention/8.1/admin/tags.md) + +Several right-click menus and additional features are available within these interfaces. + +:::tip +You can expand and collapse the Investigate, Analytics, Policies, Templates, and TAGS nodes in +the Navigation pane. +::: + + +**Agents** + +The Agents interface provides data about the Agents within the environment. This includes what +domain the Agent is in, what machine it is deployed on, its current status, and other details. This +interface also indicates if a domain controller **doesn't** have an Agent deployed on it. Through this +interface, you can deploy, update, and manage Agents; configure logging levels; access logs; and +export Agent information. + +**Alerts** + +The Alerts interface provides information on the Threat Prevention Security events, Operations +events, and Configuration events. The interface displays all events by default. However, you can +filter, sort, and search them. + +**Investigate** + +The Investigate interface is a reporting tool for the Administration Console. It provides +information on recent events monitored or blocked by any enabled policy. By default, all events +recently monitored or blocked are available. However, you can filter them to particular policies, +perpetrators, time frames, domains, servers, computers, events, etc. + +**Analytics** + +The Analytics interface is a front-line warning tool for detecting incidents in real-time based on +patterns within collected event data indicative of potential security risk. It provides information +on incidents identified by the analytic policies. + +**Policies** + +The Policies interface provides a central location for creating and configuring all policies. On +When you select the Policy node, the Display area lists the policies. The Navigation pane organizes the +policies into folders. By default, the folder structure comprises (but isn't +limited to) three folders: Auditing, Blocking, and Notifications, representing the most common types +of policies users enable. You can configure policies to monitor or block Windows Active +Directory events, Windows Exchange Server 2010, 2013, 2016, and 2019 events, Windows File System +events, NetApp File System events, EMC File System events, and Group Policy Objects events. + +You can protect a folder, which controls access to any policy within the folder. Other +Administration Console users can't view, edit, or delete a protected policy without explicit +permissions. + +**Templates** + +The Templates interface provides a central location for creating and configuring all policy +templates. When you select the Templates node, the Display area lists all available policy +templates. You must also store policy templates within a folder. You can import pre-created policy +templates. + +**TAGS** + +The TAGS node provides an organizational feature for templates. Many preconfigured templates have +tags, so users can find a template through various groupings. A tag displays the template in +different folders under the TAGS node rather than creating a duplicate template. + +## Status Bar + +The Status Bar is located at the bottom of the Administration Console. + +![statusbar](/images/threatprevention/8.1/admin/navigation/statusbar.webp) + +It displays the current user account logged into Threat Prevention and current session details. diff --git a/docs/threatprevention/8.1/admin/navigation/rightclickmenus.md b/docs/threatprevention/8.1/admin/navigation/rightclickmenus.md new file mode 100644 index 0000000000..d2676b1de6 --- /dev/null +++ b/docs/threatprevention/8.1/admin/navigation/rightclickmenus.md @@ -0,0 +1,132 @@ +--- +title: "Right-Click Menus" +description: "Right-Click Menus" +sidebar_position: 10 +--- + +# Right-Click Menus + +In the Navigation pane, the Policies node, Templates node, folders, policies, and templates have +different right-click commands available. + +**Alerts Node** + +From the Agents node, use the right-click menu to install the Agent. + +![Agents node - Right-click Menu](/images/threatprevention/8.1/admin/navigation/agentsmenu.webp) + +| Right-Click Command | Description | +| ------------------- | ----------------------- | +| Install Agent | Opens the [Deploy Agents Wizard](/docs/threatprevention/8.1/admin/agents/deploy/overview.md#deploy-agents-wizard) | + +**Saved ‘Filtered Investigate’ Nodes** + +From the node of a saved ‘Filtered Investigate’ view, use the right-click menu to delete the +saved view. + +![Saved ‘Filtered Investigate’ Nodes - Right-click Menu](/images/threatprevention/8.1/admin/navigation/savedinvestigateviewnode.webp) + +| Right-Click Command | Description | +| ------------------- | --------------------------------------------- | +| Delete | Deletes the saved ‘Filtered Investigate’ view | + +**Policies and Templates Nodes** + +From the Policies and Templates nodes, the right-click menu is limited to adding new folders to the +selected section. + +![Policies and Templates Nodes - Right-click Menu](/images/threatprevention/8.1/admin/navigation/policiestemplatesnodes.webp) + +| Right-Click Command | Description | +| --------------------- | --------------------------------------------- | +| New — Folder (Crtl+F) | Creates a new folder in the selected location | + +**Folder Node** + +From a Folder node, the right-click menu contains these commands. + +![Folder Node - Right-click Menu](/images/threatprevention/8.1/admin/navigation/foldermenu.webp) + +| Right-Click Command | Description | +| ----------------------- | ---------------------- | +| New — Policy (Crtl+P) | Creates a new policy in the selected location. Only available for folders under the Policies node. | +| New — Template (Crtl+T) | Creates a new template in the selected location. Only available for folders under the Templates node. | +| New — Folder (Crtl+F) | Creates a new folder in the selected location | +| Rename | Opens a textbox to rename the selected folder | +| Remove | Deletes the selected folder | +| Paste | Pastes a copied policy/template into the selected folder | + +:::note +If the logged in user doesn't have the **Manage Policies** permissions for a protected +policy, these options are grayed-out. See the [Policies Interface](/docs/threatprevention/8.1/admin/policies/overview.md) topic +for additional information on protection. +::: + +**Policy Name and Template Name** + +From the node for a specific policy or template, the right-click menu contains these commands. + +![`` and `