From 4d64bd63ebc2023dfe9c550b4aa46bed45d6842e Mon Sep 17 00:00:00 2001 From: alexei-belous Date: Tue, 1 Sep 2026 17:41:22 +0200 Subject: [PATCH 01/11] docs(threatprevention/8.1): scaffold 8.1 docs from 8.0 Copy the 8.0 documentation set and images to 8.1 as a baseline for the 8.1.0 release, with internal links and image paths rewritten to 8.1. Content edits follow in later commits. Not registered in src/config/products.js yet, so 8.1 stays off the site until release. Co-Authored-By: Claude Opus 5 (1M context) --- .../8.1/admin/_category_.json | 10 + .../8.1/admin/agents/_category_.json | 10 + .../agents/agent-management/_category_.json | 6 + .../agents/agent-management/clearqueue.md | 62 +++ .../admin/agents/agent-management/harden.md | 47 ++ .../agents/agent-management/removeserver.md | 25 + .../admin/agents/agent-management/soften.md | 47 ++ .../admin/agents/agent-management/start.md | 42 ++ .../agent-management/startpendingmodules.md | 33 ++ .../8.1/admin/agents/agent-management/stop.md | 41 ++ .../agent-management/upgradeadmonitor.md | 45 ++ .../agents/agents-windows/_category_.json | 6 + .../agents-windows/agentinstallerupdate.md | 46 ++ .../agents-windows/configureautodeploy.md | 40 ++ .../enrollmentsecretconfiguration.md | 51 ++ .../agents-windows/loglevelconfiguration.md | 109 ++++ .../8.1/admin/agents/deploy/_category_.json | 10 + .../8.1/admin/agents/deploy/installing.md | 20 + .../8.1/admin/agents/deploy/overview.md | 134 +++++ .../admin/agents/deploy/prerequisitescheck.md | 28 + .../admin/agents/deploy/selectcomputers.md | 60 ++ .../8.1/admin/agents/deploy/setoptions.md | 116 ++++ .../8.1/admin/agents/overview.md | 228 ++++++++ .../8.1/admin/agents/safemode.md | 105 ++++ .../8.1/admin/alerts/_category_.json | 10 + .../8.1/admin/alerts/alertscleanup.md | 50 ++ .../8.1/admin/alerts/alertsexport.md | 29 + .../8.1/admin/alerts/overview.md | 124 +++++ .../8.1/admin/alerts/policycomparison.md | 41 ++ .../8.1/admin/analytics/_category_.json | 10 + .../admin/analytics/baduseridsourcehost.md | 150 +++++ .../8.1/admin/analytics/baduseriduser.md | 148 +++++ .../8.1/admin/analytics/breachedpassword.md | 157 ++++++ .../8.1/admin/analytics/bruteforceattacks.md | 156 ++++++ .../8.1/admin/analytics/concurrentlogins.md | 160 ++++++ .../admin/analytics/filesystemattacksuser.md | 230 ++++++++ .../8.1/admin/analytics/forgedpac.md | 140 +++++ .../8.1/admin/analytics/goldenticket.md | 142 +++++ .../analytics/horizontalmovementattacks.md | 160 ++++++ .../admin/analytics/impersonationlogins.md | 155 ++++++ .../admin/analytics/kerberosweakencryption.md | 122 +++++ .../8.1/admin/analytics/overview.md | 89 +++ .../8.1/admin/analytics/useraccounthacking.md | 166 ++++++ .../8.1/admin/configuration/_category_.json | 6 + .../accessanalyzerconfiguration.md | 52 ++ .../collectionmanager/_category_.json | 10 + .../collectionmanager/dynamic.md | 201 +++++++ .../collectionmanager/listcollections.md | 143 +++++ .../collectionmanager/overview.md | 99 ++++ .../databasemaintenance/_category_.json | 10 + .../databasemaintenance/archive.md | 112 ++++ .../databasemaintenance/enable.md | 52 ++ .../databasemaintenance/overview.md | 166 ++++++ .../databasemaintenance/schedule.md | 53 ++ .../databasemaintenance/storedprocedures.md | 24 + .../8.1/admin/configuration/epesettings.md | 430 +++++++++++++++ .../eventfilteringconfiguration.md | 190 +++++++ .../eventsdatabaseconfiguration.md | 22 + .../configuration/filemonitorsettings.md | 103 ++++ .../admin/configuration/siemoutputviewer.md | 85 +++ .../systemalerting/_category_.json | 10 + .../configuration/systemalerting/email.md | 210 +++++++ .../configuration/systemalerting/eventlog.md | 49 ++ .../configuration/systemalerting/overview.md | 97 ++++ .../configuration/systemalerting/siem.md | 190 +++++++ .../threatmanagerconfiguration.md | 160 ++++++ .../configuration/userroles/_category_.json | 10 + .../8.1/admin/configuration/userroles/add.md | 41 ++ .../admin/configuration/userroles/delete.md | 25 + .../admin/configuration/userroles/modify.md | 28 + .../admin/configuration/userroles/overview.md | 93 ++++ .../8.1/admin/investigate/_category_.json | 10 + .../8.1/admin/investigate/datagrid.md | 128 +++++ .../8.1/admin/investigate/filters.md | 116 ++++ .../8.1/admin/investigate/overview.md | 26 + .../8.1/admin/investigate/saved.md | 26 + .../8.1/admin/investigate/summaryfolders.md | 67 +++ .../8.1/admin/navigation/_category_.json | 10 + .../8.1/admin/navigation/datagrid.md | 170 ++++++ .../8.1/admin/navigation/licensemanager.md | 147 +++++ .../8.1/admin/navigation/overview.md | 151 +++++ .../8.1/admin/navigation/rightclickmenus.md | 132 +++++ docs/threatprevention/8.1/admin/overview.md | 158 ++++++ .../8.1/admin/policies/_category_.json | 10 + .../policies/configuration/_category_.json | 10 + .../configuration/actions/_category_.json | 10 + .../policies/configuration/actions/file.md | 57 ++ .../configuration/actions/netscript.md | 414 ++++++++++++++ .../configuration/actions/overview.md | 165 ++++++ .../configuration/actions/powershell.md | 154 ++++++ .../policies/configuration/configuration.md | 26 + .../configuration/eventtype/_category_.json | 10 + .../eventtype/activedirectorychanges.md | 409 ++++++++++++++ .../eventtype/activedirectorylockdown.md | 194 +++++++ .../activedirectoryreadmonitoring.md | 201 +++++++ .../configuration/eventtype/adcslockdown.md | 128 +++++ .../configuration/eventtype/adcsmonitoring.md | 158 ++++++ .../eventtype/adreplicationlockdown.md | 164 ++++++ .../eventtype/adreplicationmonitoring.md | 156 ++++++ .../eventtype/authenticationlockdown.md | 164 ++++++ .../eventtype/authenticationmonitoring.md | 237 ++++++++ .../eventtype/effectivegroupmembership.md | 80 +++ .../eventtype/exchangechanges.md | 187 +++++++ .../eventtype/exchangelockdown.md | 202 +++++++ .../eventtype/filesystemaccessanalyzer.md | 137 +++++ .../filesystemchanges/_category_.json | 10 + .../filesystemchanges/filesystemchanges.md | 252 +++++++++ .../eventtype/filesystemchanges/nasdevice.md | 61 +++ .../eventtype/filesystemlockdown.md | 199 +++++++ .../eventtype/fsmorolemonitoring.md | 130 +++++ .../eventtype/gposettingchanges.md | 115 ++++ .../eventtype/gposettinglockdown.md | 108 ++++ .../eventtype/ldapbindmonitoring.md | 165 ++++++ .../configuration/eventtype/ldaplockdown.md | 177 ++++++ .../eventtype/ldapmonitoring/_category_.json | 10 + .../ldapmonitoring/ldapmonitoring.md | 238 ++++++++ .../eventtype/ldapmonitoring/ldapping.md | 57 ++ .../eventtype/ldapmonitoring/ldapsearch.md | 46 ++ .../ldapmonitoring/threatmanagerldap.md | 55 ++ .../eventtype/lsassguardianmonitor.md | 143 +++++ .../eventtype/lsassguardianprotect.md | 153 ++++++ .../configuration/eventtype/overview.md | 84 +++ .../passwordenforcement/_category_.json | 10 + .../monitorweakpasswords.md | 110 ++++ .../passwordenforcement.md | 514 ++++++++++++++++++ .../preventweakpasswords.md | 117 ++++ .../eventtype/window/_category_.json | 10 + .../eventtype/window/adcsattributelist.md | 16 + .../eventtype/window/addipaddress.md | 14 + .../eventtype/window/attributelist.md | 22 + .../eventtype/window/classlist.md | 19 + .../configuration/eventtype/window/context.md | 25 + .../eventtype/window/exchangeobjects.md | 23 + .../eventtype/window/grouppolicyobjects.md | 22 + .../configuration/eventtype/window/groups.md | 23 + .../configuration/eventtype/window/objects.md | 24 + .../eventtype/window/overview.md | 72 +++ .../eventtype/window/perpetrators.md | 31 ++ .../eventtype/window/selectcomputers.md | 32 ++ .../eventtype/window/selectdomainsservers.md | 21 + .../window/selectfilesystemobjects.md | 35 ++ .../eventtype/window/testpasswords.md | 32 ++ .../eventtype/window/trustees.md | 33 ++ .../eventtype/window/useraccountcontrol.md | 24 + .../admin/policies/configuration/general.md | 81 +++ .../recentevents/_category_.json | 10 + .../recentevents/eventtracker.md | 28 + .../configuration/recentevents/eventviewer.md | 16 + .../recentevents/executepsscript.md | 32 ++ .../configuration/recentevents/overview.md | 140 +++++ .../8.1/admin/policies/dataprotection.md | 115 ++++ .../admin/policies/exportpoliciestemplates.md | 34 ++ .../8.1/admin/policies/overview.md | 74 +++ docs/threatprevention/8.1/admin/tags.md | 20 + .../8.1/admin/templates/_category_.json | 10 + .../templates/configuration/_category_.json | 10 + .../admin/templates/configuration/actions.md | 164 ++++++ .../templates/configuration/configuration.md | 18 + .../templates/configuration/eventtype.md | 84 +++ .../admin/templates/configuration/general.md | 84 +++ .../8.1/admin/templates/createpolicy.md | 55 ++ .../admin/templates/folder/_category_.json | 10 + .../templates/folder/actions/_category_.json | 10 + .../folder/actions/accountenablement.md | 121 +++++ .../admin/templates/folder/actions/actions.md | 35 ++ .../folder/actions/lockunlockaccount.md | 122 +++++ .../folder/actions/passwordchanges.md | 137 +++++ .../folder/actions/passwordneverexpires.md | 152 ++++++ .../folder/actions/passwordrejection.md | 122 +++++ .../admin/templates/folder/activedirectory.md | 116 ++++ .../8.1/admin/templates/folder/adcs.md | 27 + .../admin/templates/folder/bestpractices.md | 55 ++ .../8.1/admin/templates/folder/dns.md | 13 + .../templates/folder/domainpersistence.md | 16 + .../8.1/admin/templates/folder/exchange.md | 65 +++ .../8.1/admin/templates/folder/filesystem.md | 37 ++ .../templates/folder/grouppolicyobjects.md | 25 + .../8.1/admin/templates/folder/hipaa.md | 109 ++++ .../8.1/admin/templates/folder/ldap.md | 17 + .../8.1/admin/templates/folder/lsass.md | 15 + .../8.1/admin/templates/folder/overview.md | 111 ++++ .../templates/folder/privilegeescalation.md | 17 + .../templates/folder/processprotection.md | 15 + .../8.1/admin/templates/folder/ransomware.md | 14 + .../admin/templates/folder/reconnaissance.md | 21 + .../templates/folder/schemaconfiguration.md | 40 ++ .../8.1/admin/templates/folder/siem.md | 22 + .../admin/templates/folder/threatmanager.md | 15 + .../8.1/admin/templates/overview.md | 53 ++ .../8.1/admin/tools/_category_.json | 6 + .../admin/tools/exportpoliciestemplates.md | 47 ++ .../8.1/admin/tools/import.md | 82 +++ docs/threatprevention/8.1/api/_category_.json | 10 + docs/threatprevention/8.1/api/collections.md | 111 ++++ docs/threatprevention/8.1/api/epe.md | 127 +++++ docs/threatprevention/8.1/api/loadmodule.md | 46 ++ docs/threatprevention/8.1/api/overview.md | 88 +++ docs/threatprevention/8.1/api/policy.md | 133 +++++ .../threatprevention/8.1/api/threatmanager.md | 100 ++++ .../8.1/eperestsite/_category_.json | 10 + .../8.1/eperestsite/accountmanagement.md | 95 ++++ .../8.1/eperestsite/checkpassword.md | 109 ++++ .../threatprevention/8.1/eperestsite/login.md | 76 +++ .../8.1/eperestsite/overview.md | 46 ++ docs/threatprevention/8.1/gettingstarted.md | 139 +++++ docs/threatprevention/8.1/index.md | 40 ++ .../8.1/install/_category_.json | 10 + .../8.1/install/adminconsole.md | 149 +++++ .../8.1/install/agent/_category_.json | 10 + .../8.1/install/agent/customcert.md | 73 +++ .../8.1/install/agent/manual.md | 218 ++++++++ .../8.1/install/agent/overview.md | 131 +++++ .../8.1/install/agent/silent.md | 72 +++ .../8.1/install/application.md | 198 +++++++ .../install/certificatemanagementwizard.md | 140 +++++ .../8.1/install/dbconnectionmanager.md | 85 +++ .../8.1/install/eperestsite.md | 161 ++++++ .../8.1/install/epeuserfeedback.md | 85 +++ .../8.1/install/firstlaunch/_category_.json | 10 + .../8.1/install/firstlaunch/firstlaunch.md | 56 ++ .../8.1/install/firstlaunch/licenseimport.md | 33 ++ .../8.1/install/migrateemserver.md | 102 ++++ docs/threatprevention/8.1/install/overview.md | 139 +++++ .../install/reportingmodule/_category_.json | 10 + .../install/reportingmodule/application.md | 89 +++ .../8.1/install/reportingmodule/database.md | 59 ++ .../install/reportingmodule/firstlaunch.md | 71 +++ .../8.1/install/reportingmodule/overview.md | 99 ++++ .../8.1/install/reportingmodule/secure.md | 144 +++++ .../8.1/install/upgrade/_category_.json | 10 + .../8.1/install/upgrade/agent.md | 82 +++ .../8.1/install/upgrade/overview.md | 215 ++++++++ .../8.1/install/upgrade/policytemplates.md | 48 ++ .../8.1/install/upgrade/reportingmodule.md | 73 +++ .../8.1/install/upgrade/uninstallagent.md | 81 +++ .../8.1/reportingmodule/_category_.json | 10 + .../configuration/_category_.json | 10 + .../integrations/_category_.json | 10 + .../integrations/activedirectorysync.md | 221 ++++++++ .../authenticationprovider/_category_.json | 10 + .../authenticationprovider/openid.md | 82 +++ .../authenticationprovider/page.md | 55 ++ .../authenticationprovider/radius.md | 131 +++++ .../authenticationprovider/saml.md | 91 ++++ .../integrations/credentialprofile.md | 148 +++++ .../configuration/integrations/email.md | 83 +++ .../integrations/foldersettings.md | 101 ++++ .../integrations/netwrixintegrations.md | 229 ++++++++ .../configuration/integrations/overview.md | 28 + .../integrations/tagmanagement.md | 163 ++++++ .../reportingmodule/configuration/overview.md | 22 + .../configuration/systemhealth.md | 40 ++ .../systemsettings/_category_.json | 10 + .../configuration/systemsettings/about.md | 28 + .../configuration/systemsettings/auditing.md | 67 +++ .../configuration/systemsettings/interface.md | 23 + .../configuration/systemsettings/licensing.md | 26 + .../systemsettings/systemjobs.md | 53 ++ .../systemsettings/useraccess.md | 246 +++++++++ .../investigations/_category_.json | 10 + .../investigations/auditcompliance.md | 47 ++ .../investigations/favorites.md | 37 ++ .../investigations/myinvestigations.md | 31 ++ .../investigations/newinvestigation.md | 72 +++ .../investigations/options/_category_.json | 10 + .../investigations/options/edit.md | 70 +++ .../investigations/options/export.md | 141 +++++ .../investigations/options/filters.md | 234 ++++++++ .../investigations/options/overview.md | 55 ++ .../investigations/options/subscription.md | 77 +++ .../investigations/overview.md | 62 +++ .../predefinedinvestigations.md | 97 ++++ .../investigations/reports/_category_.json | 10 + .../investigations/reports/group.md | 70 +++ .../investigations/reports/host.md | 43 ++ .../investigations/reports/reports.md | 121 +++++ .../investigations/reports/user.md | 41 ++ .../investigations/subscriptionsexports.md | 101 ++++ .../8.1/reportingmodule/overview.md | 23 + .../8.1/reportingmodule/threats.md | 19 + .../8.1/requirements/_category_.json | 10 + .../8.1/requirements/adminconsole.md | 60 ++ .../8.1/requirements/agent/_category_.json | 10 + .../8.1/requirements/agent/agent.md | 97 ++++ .../8.1/requirements/agent/agentnas.md | 55 ++ .../8.1/requirements/application.md | 104 ++++ .../8.1/requirements/eperestsite.md | 39 ++ .../8.1/requirements/overview.md | 75 +++ .../8.1/requirements/ports.md | 251 +++++++++ .../8.1/requirements/reportingserver.md | 76 +++ .../requirements/sqlserver/_category_.json | 10 + .../requirements/sqlserver/dbmaintenance.md | 209 +++++++ .../8.1/requirements/sqlserver/sqlserver.md | 103 ++++ .../8.1/siemdashboard/_category_.json | 10 + .../activedirectory/_category_.json | 10 + .../activedirectory/navigate/_category_.json | 10 + .../navigate/activedirectorychanges.md | 26 + .../navigate/administratorauditing.md | 27 + .../navigate/authenticationattacks.md | 18 + .../activedirectory/navigate/gpomonitoring.md | 22 + .../activedirectory/navigate/ldap.md | 20 + .../activedirectory/navigate/navigate.md | 24 + .../navigate/policyreporting.md | 34 ++ .../navigate/userbehavioranalytics.md | 26 + .../siemdashboard/activedirectory/overview.md | 85 +++ .../8.1/siemdashboard/overview.md | 19 + .../8.1/siemdashboard/qradar/_category_.json | 10 + .../qradar/navigate/_category_.json | 10 + .../siemdashboard/qradar/navigate/about.md | 13 + .../qradar/navigate/adchanges.md | 37 ++ .../qradar/navigate/administratorauditing.md | 41 ++ .../qradar/navigate/authenticationattacks.md | 24 + .../qradar/navigate/gpomonitoring.md | 33 ++ .../qradar/navigate/hostinvestigation.md | 46 ++ .../8.1/siemdashboard/qradar/navigate/ldap.md | 30 + .../siemdashboard/qradar/navigate/navigate.md | 68 +++ .../siemdashboard/qradar/navigate/overview.md | 37 ++ .../qradar/navigate/policyreporting.md | 52 ++ .../siemdashboard/qradar/navigate/settings.md | 29 + .../qradar/navigate/userinvestigation.md | 44 ++ .../8.1/siemdashboard/qradar/offenses.md | 49 ++ .../8.1/siemdashboard/qradar/overview.md | 109 ++++ .../8.1/siemdashboard/qradar/qidmap.md | 74 +++ .../threathunting/_category_.json | 10 + .../threathunting/navigate/_category_.json | 10 + .../threathunting/navigate/navigate.md | 33 ++ .../navigate/perpetratorhunting.md | 25 + .../navigate/privilegecreepescalation.md | 23 + .../navigate/sensitivedatahunting.md | 19 + .../siemdashboard/threathunting/overview.md | 91 ++++ .../8.1/solutions/_category_.json | 10 + .../8.1/solutions/activedirectory.md | 73 +++ docs/threatprevention/8.1/solutions/epe.md | 51 ++ .../8.1/solutions/exchange.md | 43 ++ .../8.1/solutions/filesystem.md | 46 ++ docs/threatprevention/8.1/solutions/ldap.md | 25 + .../8.1/solutions/overview.md | 59 ++ .../8.1/troubleshooting/_category_.json | 10 + .../8.1/troubleshooting/agentcommunication.md | 39 ++ .../8.1/troubleshooting/agentservice.md | 56 ++ .../enterprisemanagercommunication.md | 48 ++ .../8.1/troubleshooting/exchangelockdown.md | 64 +++ .../8.1/troubleshooting/lsass.md | 104 ++++ .../8.1/troubleshooting/msilogs.md | 54 ++ .../8.1/troubleshooting/overview.md | 111 ++++ .../8.1/troubleshooting/sqlserver.md | 29 + sidebars/threatprevention/8.1.js | 8 + .../8.1/admin/agents/adpendingmodealert.webp | Bin 0 -> 60604 bytes .../8.1/admin/agents/agentsinterface.webp | Bin 0 -> 51310 bytes .../8.1/admin/agents/agentstatuses.webp | Bin 0 -> 52794 bytes .../8.1/admin/agents/autodeployicon.webp | Bin 0 -> 228 bytes .../8.1/admin/agents/deploy/addfromad.webp | Bin 0 -> 31850 bytes .../8.1/admin/agents/deploy/addfromfile.webp | Bin 0 -> 8484 bytes .../8.1/admin/agents/deploy/installing.webp | Bin 0 -> 7112 bytes .../8.1/admin/agents/deploy/installpath.webp | Bin 0 -> 3508 bytes .../agents/deploy/prerequisitescheck.webp | Bin 0 -> 12624 bytes .../admin/agents/deploy/selectcomputers.webp | Bin 0 -> 8892 bytes .../8.1/admin/agents/deploy/setoptions.webp | Bin 0 -> 17648 bytes .../admin/agents/deploy/updatesetoptions.webp | Bin 0 -> 17414 bytes .../8.1/admin/agents/deployagent.webp | Bin 0 -> 302 bytes .../admin/agents/enrollmentsecreticon.webp | Bin 0 -> 232 bytes .../8.1/admin/agents/exporticon.webp | Bin 0 -> 324 bytes .../8.1/admin/agents/getagentlogicon.webp | Bin 0 -> 198 bytes .../8.1/admin/agents/refreshicon.webp | Bin 0 -> 258 bytes .../8.1/admin/agents/rightclickmenu.webp | Bin 0 -> 9632 bytes .../8.1/admin/agents/updateinstallericon.webp | Bin 0 -> 248 bytes .../8.1/admin/agents/updateloggingicon.webp | Bin 0 -> 246 bytes .../8.1/admin/agents/warningsymbol.webp | Bin 0 -> 2422 bytes .../agents/window/agentversionmismatch.webp | Bin 0 -> 9568 bytes .../8.1/admin/agents/window/autodeploy.webp | Bin 0 -> 14522 bytes .../agents/window/checkfornewversion.webp | Bin 0 -> 5654 bytes .../8.1/admin/agents/window/consolelogs.webp | Bin 0 -> 33958 bytes .../8.1/admin/agents/window/emlogs.webp | Bin 0 -> 37658 bytes .../admin/agents/window/enrollmentsecret.webp | Bin 0 -> 10890 bytes .../8.1/admin/agents/window/getagentlog.webp | Bin 0 -> 18986 bytes .../agents/window/loglevelconfiguration.webp | Bin 0 -> 33938 bytes .../8.1/admin/agents/window/saveaswindow.webp | Bin 0 -> 37380 bytes .../8.1/admin/agents/window/uptodate.webp | Bin 0 -> 6960 bytes .../8.1/admin/alerts/alertsinterface.webp | Bin 0 -> 113950 bytes .../admin/alerts/window/alertscleanup.webp | Bin 0 -> 16322 bytes .../8.1/admin/alerts/window/export.webp | Bin 0 -> 6082 bytes .../admin/alerts/window/policycomparison.webp | Bin 0 -> 80484 bytes .../analytics/accounthackingsettings.webp | Bin 0 -> 9886 bytes .../admin/analytics/analyticsinterface.webp | Bin 0 -> 18572 bytes .../8.1/admin/analytics/analyticslist.webp | Bin 0 -> 19268 bytes .../admin/analytics/baduseridsettings.webp | Bin 0 -> 4062 bytes .../admin/analytics/baduseridsourcehost.webp | Bin 0 -> 48536 bytes .../8.1/admin/analytics/baduseriduser.webp | Bin 0 -> 46752 bytes .../8.1/admin/analytics/breachedpassword.webp | Bin 0 -> 111580 bytes .../analytics/breachedpasswordsettings.webp | Bin 0 -> 6498 bytes .../8.1/admin/analytics/bruteforce.webp | Bin 0 -> 56868 bytes .../analytics/bruteforceattackssettings.webp | Bin 0 -> 8666 bytes .../8.1/admin/analytics/concurrentlogins.webp | Bin 0 -> 56714 bytes .../analytics/concurrentloginssettings.webp | Bin 0 -> 5590 bytes .../analytics/filesystemattackssettings.webp | Bin 0 -> 9412 bytes .../8.1/admin/analytics/forgedpac.webp | Bin 0 -> 23728 bytes .../admin/analytics/forgedpacsettings.webp | Bin 0 -> 7592 bytes .../8.1/admin/analytics/fsattacks.webp | Bin 0 -> 59532 bytes .../8.1/admin/analytics/goldenticket.webp | Bin 0 -> 28944 bytes .../admin/analytics/goldenticketsettings.webp | Bin 0 -> 6962 bytes .../analytics/horizontalattackssettings.webp | Bin 0 -> 7314 bytes .../admin/analytics/horizontalmovement.webp | Bin 0 -> 54046 bytes .../admin/analytics/impersonationlogins.webp | Bin 0 -> 50092 bytes .../analytics/kerberosweakencryption.webp | Bin 0 -> 36740 bytes .../8.1/admin/analytics/policytab.webp | Bin 0 -> 27242 bytes .../analytics/policytabfsmonitoring.webp | Bin 0 -> 20724 bytes .../policytabfsmonitoringlockdown.webp | Bin 0 -> 17162 bytes .../admin/analytics/useraccounthacking.webp | Bin 0 -> 44944 bytes .../addcollectionoptions.webp | Bin 0 -> 7764 bytes .../collectionmanager/addnewcollection.webp | Bin 0 -> 11670 bytes .../collectionmanager/collectionmanager.webp | Bin 0 -> 17442 bytes .../collectionmanager/confirmremoval.webp | Bin 0 -> 4488 bytes .../collectionmanager/dependencies.webp | Bin 0 -> 23580 bytes .../collectionmanager/editcollection.webp | Bin 0 -> 21394 bytes .../collectionmanager/expandgroups.webp | Bin 0 -> 2022 bytes .../collectionmanager/listofcollections.webp | Bin 0 -> 10118 bytes .../collectionmanager/selectadobjects.webp | Bin 0 -> 107288 bytes .../configuration/custommessageseditor.webp | Bin 0 -> 58408 bytes .../databasemaintenance/analytics.webp | Bin 0 -> 23670 bytes .../databasemaintenance/archivedb.webp | Bin 0 -> 10572 bytes .../archivedbmaintenance.webp | Bin 0 -> 28498 bytes .../databasemaintenance.webp | Bin 0 -> 25734 bytes .../databasemaintenance/dbmaintenancejob.webp | Bin 0 -> 19080 bytes .../databasemaintenance/enablesettings.webp | Bin 0 -> 17026 bytes .../databasemaintenance/eventtype.webp | Bin 0 -> 14626 bytes .../databasemaintenance/policy.webp | Bin 0 -> 18730 bytes .../databasemaintenance/schedule.webp | Bin 0 -> 14294 bytes .../databasemaintenance/warning.webp | Bin 0 -> 10538 bytes .../configuration/editcollectionaccounts.webp | Bin 0 -> 10524 bytes .../editcollectionaccounts_1.webp | Bin 0 -> 15050 bytes .../configuration/editcollectionhosts.webp | Bin 0 -> 16458 bytes .../editcollectionmachineaccounts.webp | Bin 0 -> 16136 bytes .../editcollectionprocesses.webp | Bin 0 -> 9794 bytes .../8.1/admin/configuration/epesettings.webp | Bin 0 -> 40214 bytes .../admin/configuration/eventfiltering.webp | Bin 0 -> 26562 bytes .../configuration/eventsdatabaseconfig.webp | Bin 0 -> 6236 bytes .../configuration/filemonitorsettings.webp | Bin 0 -> 13046 bytes .../8.1/admin/configuration/forgedpac.webp | Bin 0 -> 6652 bytes .../configuration/hibp_installation_0.webp | Bin 0 -> 59592 bytes .../configuration/hibp_installation_1.webp | Bin 0 -> 7988 bytes .../configuration/hibp_installation_3.webp | Bin 0 -> 24096 bytes .../8.1/admin/configuration/honeytoken.webp | Bin 0 -> 9770 bytes .../configuration/passworddictionary.webp | Bin 0 -> 27152 bytes .../8.1/admin/configuration/rules.webp | Bin 0 -> 11264 bytes .../admin/configuration/siemoutputviewer.webp | Bin 0 -> 26646 bytes .../configuration/substitutioneditor.webp | Bin 0 -> 10292 bytes .../systemalerting/emailtemplate.webp | Bin 0 -> 3882 bytes .../systemalerting/eventlog.webp | Bin 0 -> 50420 bytes .../geariconformappingfile.webp | Bin 0 -> 24954 bytes .../systemalerting/importfile.webp | Bin 0 -> 54262 bytes .../configuration/systemalerting/seim.webp | Bin 0 -> 72914 bytes .../systemalerting/seimserver.webp | Bin 0 -> 19456 bytes .../systemalerting/siemtemplates.webp | Bin 0 -> 14804 bytes .../systemalerting/smtphost.webp | Bin 0 -> 18846 bytes .../systemalerting/systemalerting.webp | Bin 0 -> 73006 bytes .../threatmanagerconfiguration.webp | Bin 0 -> 29286 bytes .../configuration/userroles/addbutton.webp | Bin 0 -> 11890 bytes .../userroles/featuresbutton.webp | Bin 0 -> 14466 bytes .../configuration/userroles/removeuser.webp | Bin 0 -> 12962 bytes .../userroles/selectusersorgroups.webp | Bin 0 -> 10722 bytes .../userroles/usersroleswindow.webp | Bin 0 -> 11366 bytes .../configuration/wordslistdictionary.webp | Bin 0 -> 11482 bytes .../8.1/admin/investigate/attributes.webp | Bin 0 -> 7040 bytes .../8.1/admin/investigate/datagrid.webp | Bin 0 -> 152950 bytes .../admin/investigate/filtercategories.webp | Bin 0 -> 35162 bytes .../8.1/admin/investigate/filtersetname.webp | Bin 0 -> 3372 bytes .../investigate/investigateinterface.webp | Bin 0 -> 82184 bytes .../8.1/admin/investigate/parameter.webp | Bin 0 -> 5990 bytes .../8.1/admin/investigate/savedview.webp | Bin 0 -> 9196 bytes .../8.1/admin/investigate/saveview.webp | Bin 0 -> 67578 bytes .../8.1/admin/investigate/summaryfolders.webp | Bin 0 -> 35368 bytes .../8.1/admin/investigate/summaryreport.webp | Bin 0 -> 51318 bytes .../8.1/admin/navigation/adminconsole.webp | Bin 0 -> 93296 bytes .../8.1/admin/navigation/agentsmenu.webp | Bin 0 -> 6068 bytes .../8.1/admin/navigation/customization.webp | Bin 0 -> 3964 bytes .../navigation/datagridfunctionality.webp | Bin 0 -> 57292 bytes .../8.1/admin/navigation/export.webp | Bin 0 -> 7544 bytes .../8.1/admin/navigation/filterdata.webp | Bin 0 -> 60620 bytes .../8.1/admin/navigation/filtereditor.webp | Bin 0 -> 6122 bytes .../8.1/admin/navigation/foldermenu.webp | Bin 0 -> 9970 bytes .../navigation/headerrightclickmenu.webp | Bin 0 -> 34474 bytes .../individualpolicytemplatenode.webp | Bin 0 -> 12040 bytes .../8.1/admin/navigation/licensemanager.webp | Bin 0 -> 15386 bytes .../8.1/admin/navigation/menu.webp | Bin 0 -> 5574 bytes .../navigation/policiestemplatesnodes.webp | Bin 0 -> 4904 bytes .../8.1/admin/navigation/policycenter.webp | Bin 0 -> 93564 bytes .../navigation/savedinvestigateviewnode.webp | Bin 0 -> 6060 bytes .../8.1/admin/navigation/searchfunction.webp | Bin 0 -> 1350 bytes .../8.1/admin/navigation/searchresults.webp | Bin 0 -> 63478 bytes .../admin/navigation/sortdatafunction.webp | Bin 0 -> 58770 bytes .../8.1/admin/navigation/statusbar.webp | Bin 0 -> 13270 bytes .../8.1/admin/navigation/tagsnode.webp | Bin 0 -> 5046 bytes .../navigation/templatenodeundertags.webp | Bin 0 -> 6290 bytes .../8.1/admin/navigation/valuesfilter.webp | Bin 0 -> 11286 bytes .../actions/actionsconfigurationsarea.webp | Bin 0 -> 6924 bytes .../admin/policies/actions/actionstab.webp | Bin 0 -> 15922 bytes .../policies/actions/addactionwindow.webp | Bin 0 -> 17660 bytes .../actions/addactionwindowfornetscript.webp | Bin 0 -> 28322 bytes .../actions/addactionwindowforpowershell.webp | Bin 0 -> 27616 bytes .../actions/emailnotificationssetup.webp | Bin 0 -> 10410 bytes .../admin/policies/actions/fileaction.webp | Bin 0 -> 35034 bytes .../policies/actions/netscriptaction.webp | Bin 0 -> 48646 bytes .../policies/actions/powershellaction.webp | Bin 0 -> 52588 bytes .../policies/actions/scripteditorfornet.webp | Bin 0 -> 48546 bytes .../policies/actions/scripteditorforps.webp | Bin 0 -> 33788 bytes .../8.1/admin/policies/actions/toolsmenu.webp | Bin 0 -> 13516 bytes .../8.1/admin/policies/adcontexts.webp | Bin 0 -> 47798 bytes .../admin/policies/alwaysactivebutton.webp | Bin 0 -> 326 bytes .../policies/enableddisabledpolicies.webp | Bin 0 -> 9112 bytes .../admin/policies/eventtype/adaccount.webp | Bin 0 -> 7288 bytes .../policies/eventtype/adattributes.webp | Bin 0 -> 10342 bytes .../eventtype/adattributesmonitor.webp | Bin 0 -> 4990 bytes .../admin/policies/eventtype/adchanges.webp | Bin 0 -> 21096 bytes .../admin/policies/eventtype/adclasses.webp | Bin 0 -> 3724 bytes .../eventtype/adclassesattributes.webp | Bin 0 -> 6282 bytes .../admin/policies/eventtype/adcontext.webp | Bin 0 -> 10030 bytes .../policies/eventtype/adcsattributes.webp | Bin 0 -> 11010 bytes .../policies/eventtype/adcslockdown.webp | Bin 0 -> 15076 bytes .../eventtype/adcslockdownattributes.webp | Bin 0 -> 7178 bytes .../policies/eventtype/adcsmonitoring.webp | Bin 0 -> 18242 bytes .../policies/eventtype/additionalagents.webp | Bin 0 -> 12552 bytes .../8.1/admin/policies/eventtype/adevent.webp | Bin 0 -> 5538 bytes .../eventtype/adgrouppolicyobject.webp | Bin 0 -> 11366 bytes .../eventtype/adgrouppolicyobjectchanges.webp | Bin 0 -> 9646 bytes .../admin/policies/eventtype/adgroups.webp | Bin 0 -> 2076 bytes .../admin/policies/eventtype/adlockdown.webp | Bin 0 -> 17872 bytes .../admin/policies/eventtype/adobjects.webp | Bin 0 -> 3916 bytes .../eventtype/adobjectsandcontainers.webp | Bin 0 -> 13720 bytes .../eventtype/adperpetratormonitoring.webp | Bin 0 -> 10196 bytes .../eventtype/adperpetratorprotect.webp | Bin 0 -> 6832 bytes .../policies/eventtype/adreadmonitoring.webp | Bin 0 -> 16702 bytes .../eventtype/adreplicationhostsfrom.webp | Bin 0 -> 5062 bytes .../eventtype/adreplicationlockdown.webp | Bin 0 -> 15988 bytes .../eventtype/adreplicationmonitoring.webp | Bin 0 -> 20244 bytes .../policies/eventtype/advancedadchanges.webp | Bin 0 -> 24254 bytes .../admin/policies/eventtype/advancedgpo.webp | Bin 0 -> 4054 bytes .../eventtype/authenticationlockdown.webp | Bin 0 -> 16844 bytes .../eventtype/authenticationmonitoring.webp | Bin 0 -> 25416 bytes .../authenticationprotocollockdown.webp | Bin 0 -> 7744 bytes .../authenticationprotocolmonitoring.webp | Bin 0 -> 13172 bytes .../policies/eventtype/bindprotocol.webp | Bin 0 -> 5150 bytes .../eventtype/domainsserversmonitoring.webp | Bin 0 -> 4302 bytes .../eventtype/effectivegroupmembership.webp | Bin 0 -> 10560 bytes .../policies/eventtype/eventselection.webp | Bin 0 -> 30022 bytes .../policies/eventtype/eventtypetab.webp | Bin 0 -> 6452 bytes .../policies/eventtype/exchangechanges.webp | Bin 0 -> 21920 bytes .../policies/eventtype/exchangeevent.webp | Bin 0 -> 8164 bytes .../eventtype/exchangeeventlockdown.webp | Bin 0 -> 6488 bytes .../policies/eventtype/exchangelockdown.webp | Bin 0 -> 18072 bytes .../exchangemailboxobjectsandcontainers.webp | Bin 0 -> 5988 bytes .../eventtype/exchangeperpetrator.webp | Bin 0 -> 13472 bytes .../exchangeperpetratorlockdown.webp | Bin 0 -> 12724 bytes .../policies/eventtype/exchangetrustees.webp | Bin 0 -> 10216 bytes .../eventtype/exchangetrusteeslockdown.webp | Bin 0 -> 10056 bytes .../admin/policies/eventtype/filesystem.webp | Bin 0 -> 16970 bytes .../eventtype/filesystemaccessanalyzer.webp | Bin 0 -> 21954 bytes .../eventtype/filesystemaccessanalyzer_1.webp | Bin 0 -> 10052 bytes .../policies/eventtype/filesystemagents.webp | Bin 0 -> 13332 bytes .../policies/eventtype/filesystemchanges.webp | Bin 0 -> 26606 bytes .../eventtype/filesystemlockdown.webp | Bin 0 -> 8222 bytes .../eventtype/filesystemlockdown_1.webp | Bin 0 -> 59148 bytes .../policies/eventtype/filterstatement.webp | Bin 0 -> 8500 bytes .../policies/eventtype/fsmooperations.webp | Bin 0 -> 4464 bytes .../eventtype/fsmorolemonitoring.webp | Bin 0 -> 14228 bytes .../admin/policies/eventtype/fsmoroles.webp | Bin 0 -> 7252 bytes .../eventtype/ggposettinglockdown.webp | Bin 0 -> 19028 bytes .../8.1/admin/policies/eventtype/gpo.webp | Bin 0 -> 19978 bytes .../policies/eventtype/gposettingchanges.webp | Bin 0 -> 18690 bytes .../admin/policies/eventtype/hostsfrom.webp | Bin 0 -> 7382 bytes .../policies/eventtype/hostsfromlockdown.webp | Bin 0 -> 3582 bytes .../8.1/admin/policies/eventtype/hoststo.webp | Bin 0 -> 6830 bytes .../policies/eventtype/hoststolockdown.webp | Bin 0 -> 3234 bytes .../policies/eventtype/ipaddressesfrom.webp | Bin 0 -> 8492 bytes .../policies/eventtype/ipaddressesto.webp | Bin 0 -> 7970 bytes .../8.1/admin/policies/eventtype/ldap.webp | Bin 0 -> 7998 bytes .../policies/eventtype/ldapattributes.webp | Bin 0 -> 4534 bytes .../admin/policies/eventtype/ldapbind.webp | Bin 0 -> 51830 bytes .../policies/eventtype/ldapbindmonitor.webp | Bin 0 -> 21238 bytes .../policies/eventtype/ldaplockdown.webp | Bin 0 -> 18462 bytes .../policies/eventtype/ldapmonitoring.webp | Bin 0 -> 21238 bytes .../admin/policies/eventtype/ldapquery.webp | Bin 0 -> 3136 bytes .../policies/eventtype/ldapquerylockdown.webp | Bin 0 -> 2300 bytes .../admin/policies/eventtype/ldapruntime.webp | Bin 0 -> 10070 bytes .../policies/eventtype/lsassmonitor.webp | Bin 0 -> 21754 bytes .../policies/eventtype/lsassprotect.webp | Bin 0 -> 17340 bytes .../eventtype/openprocessflagsmonitoring.webp | Bin 0 -> 18928 bytes .../eventtype/passwordenforcement.webp | Bin 0 -> 14184 bytes .../policies/eventtype/passwordrules.webp | Bin 0 -> 53168 bytes .../8.1/admin/policies/eventtype/paths.webp | Bin 0 -> 8730 bytes .../admin/policies/eventtype/permissions.webp | Bin 0 -> 20472 bytes .../eventtype/perpetratorstoexclude.webp | Bin 0 -> 5176 bytes .../eventtype/processesandconfiguration.webp | Bin 0 -> 6858 bytes .../eventtype/processesmonitoring.webp | Bin 0 -> 8092 bytes .../policies/eventtype/processesprotect.webp | Bin 0 -> 6294 bytes .../admin/policies/eventtype/queryresult.webp | Bin 0 -> 5500 bytes .../admin/policies/eventtype/rulepreview.webp | Bin 0 -> 11238 bytes .../admin/policies/eventtype/subfolder.webp | Bin 0 -> 3668 bytes .../8.1/admin/policies/eventtype/subtree.webp | Bin 0 -> 4542 bytes .../8.1/admin/policies/eventtype/success.webp | Bin 0 -> 4798 bytes .../eventtype/targetprocesseslockdown.webp | Bin 0 -> 5320 bytes .../eventtype/targetprocessesmonitoring.webp | Bin 0 -> 5320 bytes .../eventtype/usecase/honeytoken.webp | Bin 0 -> 72218 bytes .../usecase/invesitgatenodeblock.webp | Bin 0 -> 21098 bytes .../usecase/invesitgatenodemonitor.webp | Bin 0 -> 20312 bytes .../usecase/ldapfiltercopiedtoclipboard.webp | Bin 0 -> 2106 bytes .../usecase/ldapmonitoringfortm.webp | Bin 0 -> 33706 bytes .../policies/eventtype/usecase/ldapping.webp | Bin 0 -> 5724 bytes .../eventtype/usecase/ldapsearchscopes.webp | Bin 0 -> 13250 bytes .../eventtype/usecase/newblockepepolicy.webp | Bin 0 -> 9862 bytes .../usecase/newmonitorepepolicy.webp | Bin 0 -> 10166 bytes .../eventtype/usecase/passwordrulesblock.webp | Bin 0 -> 54890 bytes .../usecase/passwordrulesmonitor.webp | Bin 0 -> 54518 bytes .../usecase/recenteventsmonitor.webp | Bin 0 -> 48830 bytes .../usecase/recenteventsprevent.webp | Bin 0 -> 124236 bytes .../eventtype/useraccountcontrol.webp | Bin 0 -> 18116 bytes .../eventtype/window/adcsattributelist.webp | Bin 0 -> 43384 bytes .../eventtype/window/addipaddress.webp | Bin 0 -> 2946 bytes .../eventtype/window/adperpetrators.webp | Bin 0 -> 72046 bytes .../eventtype/window/attributelist.webp | Bin 0 -> 37238 bytes .../policies/eventtype/window/classlist.webp | Bin 0 -> 23502 bytes .../eventtype/window/filesystemobjects.webp | Bin 0 -> 28952 bytes .../window/filesystemobjectsnas.webp | Bin 0 -> 10722 bytes .../eventtype/window/passwordtestfailed.webp | Bin 0 -> 12636 bytes .../eventtype/window/passwordtestpassed.webp | Bin 0 -> 10094 bytes .../policies/eventtype/window/searchmode.webp | Bin 0 -> 33162 bytes .../window/selectactivedirectory/adgpo.webp | Bin 0 -> 28018 bytes .../selectactivedirectory/adgroups.webp | Bin 0 -> 40818 bytes .../selectactivedirectory/adobjects.webp | Bin 0 -> 149110 bytes .../selectactivedirectory/adtrustees.webp | Bin 0 -> 75298 bytes .../exchangeobjectsfromad.webp | Bin 0 -> 49874 bytes .../eventtype/window/selectagent.webp | Bin 0 -> 7382 bytes .../eventtype/window/selectcomputers.webp | Bin 0 -> 92570 bytes .../window/selectdomainsservers.webp | Bin 0 -> 12630 bytes .../eventtype/window/testpasswords.webp | Bin 0 -> 8374 bytes .../window/useraccountcontrolattribute.webp | Bin 0 -> 12260 bytes .../eventtype/window/useraccountcotrol.webp | Bin 0 -> 24782 bytes .../8.1/admin/policies/export.webp | Bin 0 -> 5742 bytes .../8.1/admin/policies/generaltab.webp | Bin 0 -> 30556 bytes .../8.1/admin/policies/history.webp | Bin 0 -> 7988 bytes .../8.1/admin/policies/permissions.webp | Bin 0 -> 13130 bytes .../8.1/admin/policies/policiesinterface.webp | Bin 0 -> 66314 bytes .../admin/policies/policyrightclickkmenu.webp | Bin 0 -> 7626 bytes .../policies/recentevents/eventtracker.webp | Bin 0 -> 6768 bytes .../policies/recentevents/eventviewer.webp | Bin 0 -> 45072 bytes .../recentevents/recenteventdetails.webp | Bin 0 -> 5332 bytes .../recentevents/recenteventstab.webp | Bin 0 -> 79166 bytes .../policies/recentevents/rightclickmenu.webp | Bin 0 -> 2310 bytes .../8.1/admin/policies/schedule.webp | Bin 0 -> 17748 bytes .../admin/policies/schedulespecifictimes.webp | Bin 0 -> 19792 bytes .../8.1/admin/policies/selectuser.webp | Bin 0 -> 6454 bytes .../admin/policies/specifictimesbutton.webp | Bin 0 -> 334 bytes .../8.1/admin/systemdiagram.webp | Bin 0 -> 21128 bytes .../threatprevention/8.1/admin/tags/tags.webp | Bin 0 -> 26650 bytes .../8.1/admin/templates/actionstab.webp | Bin 0 -> 45936 bytes .../8.1/admin/templates/eventtypetab.webp | Bin 0 -> 21976 bytes .../8.1/admin/templates/generaltab.webp | Bin 0 -> 38286 bytes .../8.1/admin/templates/import.webp | Bin 0 -> 114922 bytes .../8.1/admin/templates/rightclickmenu.webp | Bin 0 -> 8396 bytes .../8.1/admin/templates/templates.webp | Bin 0 -> 133130 bytes .../admin/tools/exportpoliciestemplates.webp | Bin 0 -> 17282 bytes .../8.1/admin/tools/import.webp | Bin 0 -> 24766 bytes .../8.1/eperestsite/basic.webp | Bin 0 -> 42760 bytes .../8.1/eperestsite/bearer.webp | Bin 0 -> 43054 bytes .../8.1/eperestsite/create.webp | Bin 0 -> 45684 bytes .../8.1/eperestsite/delete.webp | Bin 0 -> 29750 bytes .../8.1/eperestsite/digest.webp | Bin 0 -> 43888 bytes .../8.1/eperestsite/login.webp | Bin 0 -> 32952 bytes .../8.1/eperestsite/logoff.webp | Bin 0 -> 35532 bytes .../8.1/eperestsite/token.webp | Bin 0 -> 42194 bytes .../8.1/eperestsite/userid.webp | Bin 0 -> 40364 bytes .../8.1/eperestsite/username.webp | Bin 0 -> 41856 bytes .../8.1/eperestsite/users.webp | Bin 0 -> 51240 bytes .../8.1/install/agent/cacertconfig.webp | Bin 0 -> 45989 bytes .../8.1/install/agent/certificates.webp | Bin 0 -> 12748 bytes .../8.1/install/agent/changedestination.webp | Bin 0 -> 47019 bytes .../8.1/install/agent/destinationfolder.webp | Bin 0 -> 57324 bytes .../8.1/install/agent/enterprisemanager.webp | Bin 0 -> 27528 bytes .../8.1/install/agent/eventsources.webp | Bin 0 -> 20898 bytes .../8.1/install/agent/license.webp | Bin 0 -> 38386 bytes .../8.1/install/agent/readytoinstall.webp | Bin 0 -> 56078 bytes .../8.1/install/agent/success.webp | Bin 0 -> 42258 bytes .../8.1/install/agent/welcome.webp | Bin 0 -> 55823 bytes .../8.1/install/agent/welcome2.webp | Bin 0 -> 16298 bytes .../8.1/install/certificatesimported.webp | Bin 0 -> 10858 bytes .../8.1/install/changedestinationfolder.webp | Bin 0 -> 13344 bytes .../8.1/install/complete.webp | Bin 0 -> 11508 bytes .../8.1/install/csrfilescreated.webp | Bin 0 -> 18256 bytes .../8.1/install/customsetup.webp | Bin 0 -> 21950 bytes .../8.1/install/customsetup_1.webp | Bin 0 -> 24958 bytes .../8.1/install/database.webp | Bin 0 -> 18660 bytes .../8.1/install/databselogininfor.webp | Bin 0 -> 17532 bytes .../8.1/install/dbconnectionmanager.webp | Bin 0 -> 25582 bytes .../8.1/install/desktopicon.webp | Bin 0 -> 2062 bytes .../install/emlocationforremoteconsole.webp | Bin 0 -> 15460 bytes .../8.1/install/emlocationinfo.webp | Bin 0 -> 16818 bytes .../8.1/install/exportcertificate.webp | Bin 0 -> 9654 bytes .../install/grouppolicymanagementconsole.webp | Bin 0 -> 43238 bytes .../install/grouppolicymanagementeditor.webp | Bin 0 -> 49144 bytes .../install/importcertificateauthority.webp | Bin 0 -> 20372 bytes .../8.1/install/importlicense.webp | Bin 0 -> 97318 bytes .../8.1/install/importsignedcertificates.webp | Bin 0 -> 10564 bytes .../8.1/install/importtemplates.webp | Bin 0 -> 5342 bytes .../8.1/install/installagent.webp | Bin 0 -> 6768 bytes .../8.1/install/installnet.webp | Bin 0 -> 10160 bytes .../8.1/install/licenseagreement.webp | Bin 0 -> 30778 bytes .../threatprevention/8.1/install/logon.webp | Bin 0 -> 20204 bytes .../8.1/install/netrequired.webp | Bin 0 -> 13502 bytes .../8.1/install/readytoinstall.webp | Bin 0 -> 13346 bytes .../reportingmodule/applicationcheck.webp | Bin 0 -> 28110 bytes .../reportingmodule/builtinadminpassword.webp | Bin 0 -> 7292 bytes .../install/reportingmodule/completed.webp | Bin 0 -> 10850 bytes .../install/reportingmodule/completed_1.webp | Bin 0 -> 12168 bytes .../8.1/install/reportingmodule/database.webp | Bin 0 -> 15196 bytes .../databasecreatemessage.webp | Bin 0 -> 4492 bytes .../reportingmodule/databaseready.webp | Bin 0 -> 17350 bytes .../install/reportingmodule/desktopicon.webp | Bin 0 -> 2376 bytes .../8.1/install/reportingmodule/eula.webp | Bin 0 -> 46208 bytes .../8.1/install/reportingmodule/eula_1.webp | Bin 0 -> 38224 bytes .../reportingmodule/firewallrules.webp | Bin 0 -> 7956 bytes .../8.1/install/reportingmodule/folder.webp | Bin 0 -> 11728 bytes .../8.1/install/reportingmodule/folder_1.webp | Bin 0 -> 9048 bytes .../8.1/install/reportingmodule/install.webp | Bin 0 -> 13200 bytes .../reportingmodule/postgresqlcheck.webp | Bin 0 -> 27674 bytes .../registerauthenticator.webp | Bin 0 -> 27006 bytes .../reportingmodule/setuplauncher.webp | Bin 0 -> 27264 bytes .../8.1/install/selectaction.webp | Bin 0 -> 23818 bytes .../8.1/install/selectactioncomplete.webp | Bin 0 -> 23874 bytes .../8.1/install/selectcomponents.webp | Bin 0 -> 10924 bytes .../install/upgrade/accessverification.webp | Bin 0 -> 7668 bytes .../8.1/install/upgrade/entercredentials.webp | Bin 0 -> 3782 bytes .../8.1/install/upgrade/eula.webp | Bin 0 -> 31696 bytes .../8.1/install/upgrade/install.webp | Bin 0 -> 7470 bytes .../8.1/install/upgrade/install_1.webp | Bin 0 -> 6672 bytes .../8.1/install/upgrade/tm3installation.webp | Bin 0 -> 27986 bytes .../8.1/install/upgrade/upgradeagent.webp | Bin 0 -> 7374 bytes .../8.1/install/upgrade/upgradeappprompt.webp | Bin 0 -> 10220 bytes .../8.1/install/upgrade/upgradedbprompt.webp | Bin 0 -> 12112 bytes .../threatprevention/8.1/install/welcome.webp | Bin 0 -> 15666 bytes .../8.1/install/winconsoleicon.webp | Bin 0 -> 2106 bytes .../8.1/install/windowsauthentication.webp | Bin 0 -> 17916 bytes .../integrations/activedirectorysync.webp | Bin 0 -> 10320 bytes .../integrations/additionaloptions.webp | Bin 0 -> 2518 bytes .../integrations/addnewintegration.webp | Bin 0 -> 11786 bytes .../addnewsharedfolderwindow.webp | Bin 0 -> 15302 bytes .../authenticationprovider.webp | Bin 0 -> 7468 bytes .../configurationopenid.webp | Bin 0 -> 10274 bytes .../configurationradius.webp | Bin 0 -> 10298 bytes .../configurationsaml.webp | Bin 0 -> 11080 bytes .../customizationtab.webp | Bin 0 -> 9554 bytes .../authenticationprovider/openid.webp | Bin 0 -> 30024 bytes .../authenticationprovider/page.webp | Bin 0 -> 23730 bytes .../authenticationprovider/radius.webp | Bin 0 -> 30166 bytes .../authenticationprovider/saml.webp | Bin 0 -> 30230 bytes .../authenticationprovider/type.webp | Bin 0 -> 24646 bytes .../usersgroupstab.webp | Bin 0 -> 18024 bytes .../integrations/configurationtab.webp | Bin 0 -> 13440 bytes .../integrations/credentialprofile.webp | Bin 0 -> 10938 bytes .../credentialsettingswindow.webp | Bin 0 -> 4832 bytes .../configuration/integrations/details.webp | Bin 0 -> 25830 bytes .../configuration/integrations/details_1.webp | Bin 0 -> 26636 bytes .../configuration/integrations/details_2.webp | Bin 0 -> 29332 bytes .../configuration/integrations/details_3.webp | Bin 0 -> 13056 bytes .../configuration/integrations/details_4.webp | Bin 0 -> 43328 bytes .../integrations/domainconfigurationtab.webp | Bin 0 -> 11518 bytes .../integrations/editnetwrixintegration.webp | Bin 0 -> 5326 bytes .../integrations/editprofile.webp | Bin 0 -> 3986 bytes .../configuration/integrations/interface.webp | Bin 0 -> 31782 bytes .../integrations/localfolder.webp | Bin 0 -> 11356 bytes .../configuration/integrations/page.webp | Bin 0 -> 24086 bytes .../configuration/integrations/page_1.webp | Bin 0 -> 23294 bytes .../configuration/integrations/page_2.webp | Bin 0 -> 31266 bytes .../configuration/integrations/page_3.webp | Bin 0 -> 28986 bytes .../configuration/integrations/page_4.webp | Bin 0 -> 33032 bytes .../configuration/integrations/page_5.webp | Bin 0 -> 71850 bytes .../integrations/policysynctab.webp | Bin 0 -> 103200 bytes .../configuration/integrations/search.webp | Bin 0 -> 26740 bytes .../integrations/searchselect.webp | Bin 0 -> 14828 bytes .../integrations/sharedfoldertable.webp | Bin 0 -> 12346 bytes .../integrations/synchistorytab.webp | Bin 0 -> 55040 bytes .../integrations/tagmanagement.webp | Bin 0 -> 4600 bytes .../integrations/typefilters.webp | Bin 0 -> 21072 bytes .../reportingmodule/configuration/menu.webp | Bin 0 -> 4790 bytes .../configuration/servicesdetails.webp | Bin 0 -> 39382 bytes .../configuration/servicespage.webp | Bin 0 -> 21598 bytes .../configuration/systemsettings/about.webp | Bin 0 -> 28506 bytes .../systemsettings/addconsoleaccess.webp | Bin 0 -> 9380 bytes .../systemsettings/editaccess.webp | Bin 0 -> 23448 bytes .../editpasswordbuiltinadmin.webp | Bin 0 -> 7530 bytes .../systemsettings/interface.webp | Bin 0 -> 56420 bytes .../systemsettings/licensing.webp | Bin 0 -> 15436 bytes .../configuration/systemsettings/page.webp | Bin 0 -> 15532 bytes .../systemsettings/reporthealth.webp | Bin 0 -> 6016 bytes .../systemsettings/reportsettings.webp | Bin 0 -> 35614 bytes .../systemsettings/settings.webp | Bin 0 -> 10096 bytes .../systemsettings/useraccess.webp | Bin 0 -> 46424 bytes .../systemsettings/usersgroups.webp | Bin 0 -> 20206 bytes .../8.1/reportingmodule/interface.webp | Bin 0 -> 25562 bytes .../investigations/auditcompliance.webp | Bin 0 -> 28796 bytes .../investigations/eventdetails.webp | Bin 0 -> 90610 bytes .../investigations/eventsovertime.webp | Bin 0 -> 10738 bytes .../investigations/favorites.webp | Bin 0 -> 22936 bytes .../investigations/favoriteselectedtm.webp | Bin 0 -> 6088 bytes .../investigations/filterwindow.webp | Bin 0 -> 2038 bytes .../investigations/groupdetails.webp | Bin 0 -> 32050 bytes .../investigations/groupmembershiptab.webp | Bin 0 -> 7656 bytes .../investigations/hostdetails.webp | Bin 0 -> 30088 bytes .../investigations/myinvestigations.webp | Bin 0 -> 19976 bytes .../investigations/newinvestigation.webp | Bin 0 -> 25506 bytes .../options/attrributemenu.webp | Bin 0 -> 5092 bytes .../options/editinvestigationtm.webp | Bin 0 -> 6194 bytes .../investigations/options/export.webp | Bin 0 -> 11676 bytes .../investigations/options/filters.webp | Bin 0 -> 6400 bytes .../investigations/options/filtersimple.webp | Bin 0 -> 8162 bytes .../options/investigationduplicate.webp | Bin 0 -> 6774 bytes .../options/investigationoptions.webp | Bin 0 -> 9458 bytes .../investigations/options/operatormenu.webp | Bin 0 -> 3776 bytes .../options/scheduleexport.webp | Bin 0 -> 21068 bytes .../investigations/options/sendasemail.webp | Bin 0 -> 7820 bytes .../investigations/options/subscription.webp | Bin 0 -> 18114 bytes .../investigations/options/timeframe.webp | Bin 0 -> 11894 bytes .../predefinedinvestigations.webp | Bin 0 -> 32878 bytes .../investigations/saveinvestigation.webp | Bin 0 -> 6650 bytes .../investigations/search.webp | Bin 0 -> 11892 bytes .../investigations/subscriptionsexports.webp | Bin 0 -> 22740 bytes .../subscriptionsexportsactions.webp | Bin 0 -> 2170 bytes .../investigations/tableoptions.webp | Bin 0 -> 8494 bytes .../investigations/topresources.webp | Bin 0 -> 14436 bytes .../investigations/userdetails.webp | Bin 0 -> 27388 bytes .../8.1/reportingmodule/threats.webp | Bin 0 -> 56386 bytes .../siemdashboard/qradar/dashboard/about.webp | Bin 0 -> 22004 bytes .../qradar/dashboard/adchanges.webp | Bin 0 -> 28598 bytes .../dashboard/administratorauditing.webp | Bin 0 -> 31088 bytes .../dashboard/authenticationattacks.webp | Bin 0 -> 41104 bytes .../qradar/dashboard/gpomonitoring.webp | Bin 0 -> 15476 bytes .../qradar/dashboard/hostinvestigation.webp | Bin 0 -> 37474 bytes .../siemdashboard/qradar/dashboard/ldap.webp | Bin 0 -> 25726 bytes .../qradar/dashboard/overview.webp | Bin 0 -> 18532 bytes .../qradar/dashboard/policyreporting.webp | Bin 0 -> 45930 bytes .../qradar/dashboard/userinvestigation.webp | Bin 0 -> 37336 bytes .../8.1/siemdashboard/qradar/offenses.webp | Bin 0 -> 28946 bytes .../8.1/siemdashboard/qradar/settings.webp | Bin 0 -> 7732 bytes .../8.1/siemdashboard/qradar/topribbon.webp | Bin 0 -> 19398 bytes .../activedirectory/dashboard/adchanges.webp | Bin 0 -> 50340 bytes .../dashboard/administratorauditing.webp | Bin 0 -> 43464 bytes .../dashboard/authenticationattacks.webp | Bin 0 -> 19204 bytes .../dashboard/gpomonitoring.webp | Bin 0 -> 40168 bytes .../activedirectory/dashboard/ldap.webp | Bin 0 -> 58292 bytes .../dashboard/policyreporting.webp | Bin 0 -> 40684 bytes .../dashboard/userbehavioranalytics.webp | Bin 0 -> 15142 bytes .../splunk/activedirectory/topribbon.webp | Bin 0 -> 12250 bytes .../dashboard/perpetratorhunting.webp | Bin 0 -> 132890 bytes .../dashboard/privilegecreep.webp | Bin 0 -> 46620 bytes .../dashboard/sensitivedatahunting.webp | Bin 0 -> 30024 bytes .../splunk/threathunting/ribbon.webp | Bin 0 -> 9306 bytes .../8.1/troubleshooting/delegates.webp | Bin 0 -> 31382 bytes .../8.1/troubleshooting/inboxproperties.webp | Bin 0 -> 18906 bytes .../lsassprocessterminated.webp | Bin 0 -> 62388 bytes .../troubleshooting/permissionnotsaved.webp | Bin 0 -> 5432 bytes .../8.1/troubleshooting/serverproperties.webp | Bin 0 -> 29764 bytes .../sqlservermanagementstudio.webp | Bin 0 -> 31218 bytes .../8.1/troubleshooting/warning.webp | Bin 0 -> 8768 bytes 861 files changed, 26717 insertions(+) create mode 100644 docs/threatprevention/8.1/admin/_category_.json create mode 100644 docs/threatprevention/8.1/admin/agents/_category_.json create mode 100644 docs/threatprevention/8.1/admin/agents/agent-management/_category_.json create mode 100644 docs/threatprevention/8.1/admin/agents/agent-management/clearqueue.md create mode 100644 docs/threatprevention/8.1/admin/agents/agent-management/harden.md create mode 100644 docs/threatprevention/8.1/admin/agents/agent-management/removeserver.md create mode 100644 docs/threatprevention/8.1/admin/agents/agent-management/soften.md create mode 100644 docs/threatprevention/8.1/admin/agents/agent-management/start.md create mode 100644 docs/threatprevention/8.1/admin/agents/agent-management/startpendingmodules.md create mode 100644 docs/threatprevention/8.1/admin/agents/agent-management/stop.md create mode 100644 docs/threatprevention/8.1/admin/agents/agent-management/upgradeadmonitor.md create mode 100644 docs/threatprevention/8.1/admin/agents/agents-windows/_category_.json create mode 100644 docs/threatprevention/8.1/admin/agents/agents-windows/agentinstallerupdate.md create mode 100644 docs/threatprevention/8.1/admin/agents/agents-windows/configureautodeploy.md create mode 100644 docs/threatprevention/8.1/admin/agents/agents-windows/enrollmentsecretconfiguration.md create mode 100644 docs/threatprevention/8.1/admin/agents/agents-windows/loglevelconfiguration.md create mode 100644 docs/threatprevention/8.1/admin/agents/deploy/_category_.json create mode 100644 docs/threatprevention/8.1/admin/agents/deploy/installing.md create mode 100644 docs/threatprevention/8.1/admin/agents/deploy/overview.md create mode 100644 docs/threatprevention/8.1/admin/agents/deploy/prerequisitescheck.md create mode 100644 docs/threatprevention/8.1/admin/agents/deploy/selectcomputers.md create mode 100644 docs/threatprevention/8.1/admin/agents/deploy/setoptions.md create mode 100644 docs/threatprevention/8.1/admin/agents/overview.md create mode 100644 docs/threatprevention/8.1/admin/agents/safemode.md create mode 100644 docs/threatprevention/8.1/admin/alerts/_category_.json create mode 100644 docs/threatprevention/8.1/admin/alerts/alertscleanup.md create mode 100644 docs/threatprevention/8.1/admin/alerts/alertsexport.md create mode 100644 docs/threatprevention/8.1/admin/alerts/overview.md create mode 100644 docs/threatprevention/8.1/admin/alerts/policycomparison.md create mode 100644 docs/threatprevention/8.1/admin/analytics/_category_.json create mode 100644 docs/threatprevention/8.1/admin/analytics/baduseridsourcehost.md create mode 100644 docs/threatprevention/8.1/admin/analytics/baduseriduser.md create mode 100644 docs/threatprevention/8.1/admin/analytics/breachedpassword.md create mode 100644 docs/threatprevention/8.1/admin/analytics/bruteforceattacks.md create mode 100644 docs/threatprevention/8.1/admin/analytics/concurrentlogins.md create mode 100644 docs/threatprevention/8.1/admin/analytics/filesystemattacksuser.md create mode 100644 docs/threatprevention/8.1/admin/analytics/forgedpac.md create mode 100644 docs/threatprevention/8.1/admin/analytics/goldenticket.md create mode 100644 docs/threatprevention/8.1/admin/analytics/horizontalmovementattacks.md create mode 100644 docs/threatprevention/8.1/admin/analytics/impersonationlogins.md create mode 100644 docs/threatprevention/8.1/admin/analytics/kerberosweakencryption.md create mode 100644 docs/threatprevention/8.1/admin/analytics/overview.md create mode 100644 docs/threatprevention/8.1/admin/analytics/useraccounthacking.md create mode 100644 docs/threatprevention/8.1/admin/configuration/_category_.json create mode 100644 docs/threatprevention/8.1/admin/configuration/accessanalyzerconfiguration.md create mode 100644 docs/threatprevention/8.1/admin/configuration/collectionmanager/_category_.json create mode 100644 docs/threatprevention/8.1/admin/configuration/collectionmanager/dynamic.md create mode 100644 docs/threatprevention/8.1/admin/configuration/collectionmanager/listcollections.md create mode 100644 docs/threatprevention/8.1/admin/configuration/collectionmanager/overview.md create mode 100644 docs/threatprevention/8.1/admin/configuration/databasemaintenance/_category_.json create mode 100644 docs/threatprevention/8.1/admin/configuration/databasemaintenance/archive.md create mode 100644 docs/threatprevention/8.1/admin/configuration/databasemaintenance/enable.md create mode 100644 docs/threatprevention/8.1/admin/configuration/databasemaintenance/overview.md create mode 100644 docs/threatprevention/8.1/admin/configuration/databasemaintenance/schedule.md create mode 100644 docs/threatprevention/8.1/admin/configuration/databasemaintenance/storedprocedures.md create mode 100644 docs/threatprevention/8.1/admin/configuration/epesettings.md create mode 100644 docs/threatprevention/8.1/admin/configuration/eventfilteringconfiguration.md create mode 100644 docs/threatprevention/8.1/admin/configuration/eventsdatabaseconfiguration.md create mode 100644 docs/threatprevention/8.1/admin/configuration/filemonitorsettings.md create mode 100644 docs/threatprevention/8.1/admin/configuration/siemoutputviewer.md create mode 100644 docs/threatprevention/8.1/admin/configuration/systemalerting/_category_.json create mode 100644 docs/threatprevention/8.1/admin/configuration/systemalerting/email.md create mode 100644 docs/threatprevention/8.1/admin/configuration/systemalerting/eventlog.md create mode 100644 docs/threatprevention/8.1/admin/configuration/systemalerting/overview.md create mode 100644 docs/threatprevention/8.1/admin/configuration/systemalerting/siem.md create mode 100644 docs/threatprevention/8.1/admin/configuration/threatmanagerconfiguration.md create mode 100644 docs/threatprevention/8.1/admin/configuration/userroles/_category_.json create mode 100644 docs/threatprevention/8.1/admin/configuration/userroles/add.md create mode 100644 docs/threatprevention/8.1/admin/configuration/userroles/delete.md create mode 100644 docs/threatprevention/8.1/admin/configuration/userroles/modify.md create mode 100644 docs/threatprevention/8.1/admin/configuration/userroles/overview.md create mode 100644 docs/threatprevention/8.1/admin/investigate/_category_.json create mode 100644 docs/threatprevention/8.1/admin/investigate/datagrid.md create mode 100644 docs/threatprevention/8.1/admin/investigate/filters.md create mode 100644 docs/threatprevention/8.1/admin/investigate/overview.md create mode 100644 docs/threatprevention/8.1/admin/investigate/saved.md create mode 100644 docs/threatprevention/8.1/admin/investigate/summaryfolders.md create mode 100644 docs/threatprevention/8.1/admin/navigation/_category_.json create mode 100644 docs/threatprevention/8.1/admin/navigation/datagrid.md create mode 100644 docs/threatprevention/8.1/admin/navigation/licensemanager.md create mode 100644 docs/threatprevention/8.1/admin/navigation/overview.md create mode 100644 docs/threatprevention/8.1/admin/navigation/rightclickmenus.md create mode 100644 docs/threatprevention/8.1/admin/overview.md create mode 100644 docs/threatprevention/8.1/admin/policies/_category_.json create mode 100644 docs/threatprevention/8.1/admin/policies/configuration/_category_.json create mode 100644 docs/threatprevention/8.1/admin/policies/configuration/actions/_category_.json create mode 100644 docs/threatprevention/8.1/admin/policies/configuration/actions/file.md create mode 100644 docs/threatprevention/8.1/admin/policies/configuration/actions/netscript.md create mode 100644 docs/threatprevention/8.1/admin/policies/configuration/actions/overview.md create mode 100644 docs/threatprevention/8.1/admin/policies/configuration/actions/powershell.md create mode 100644 docs/threatprevention/8.1/admin/policies/configuration/configuration.md create mode 100644 docs/threatprevention/8.1/admin/policies/configuration/eventtype/_category_.json create mode 100644 docs/threatprevention/8.1/admin/policies/configuration/eventtype/activedirectorychanges.md create mode 100644 docs/threatprevention/8.1/admin/policies/configuration/eventtype/activedirectorylockdown.md create mode 100644 docs/threatprevention/8.1/admin/policies/configuration/eventtype/activedirectoryreadmonitoring.md create mode 100644 docs/threatprevention/8.1/admin/policies/configuration/eventtype/adcslockdown.md create mode 100644 docs/threatprevention/8.1/admin/policies/configuration/eventtype/adcsmonitoring.md create mode 100644 docs/threatprevention/8.1/admin/policies/configuration/eventtype/adreplicationlockdown.md create mode 100644 docs/threatprevention/8.1/admin/policies/configuration/eventtype/adreplicationmonitoring.md create mode 100644 docs/threatprevention/8.1/admin/policies/configuration/eventtype/authenticationlockdown.md create mode 100644 docs/threatprevention/8.1/admin/policies/configuration/eventtype/authenticationmonitoring.md create mode 100644 docs/threatprevention/8.1/admin/policies/configuration/eventtype/effectivegroupmembership.md create mode 100644 docs/threatprevention/8.1/admin/policies/configuration/eventtype/exchangechanges.md create mode 100644 docs/threatprevention/8.1/admin/policies/configuration/eventtype/exchangelockdown.md create mode 100644 docs/threatprevention/8.1/admin/policies/configuration/eventtype/filesystemaccessanalyzer.md create mode 100644 docs/threatprevention/8.1/admin/policies/configuration/eventtype/filesystemchanges/_category_.json create mode 100644 docs/threatprevention/8.1/admin/policies/configuration/eventtype/filesystemchanges/filesystemchanges.md create mode 100644 docs/threatprevention/8.1/admin/policies/configuration/eventtype/filesystemchanges/nasdevice.md create mode 100644 docs/threatprevention/8.1/admin/policies/configuration/eventtype/filesystemlockdown.md create mode 100644 docs/threatprevention/8.1/admin/policies/configuration/eventtype/fsmorolemonitoring.md create mode 100644 docs/threatprevention/8.1/admin/policies/configuration/eventtype/gposettingchanges.md create mode 100644 docs/threatprevention/8.1/admin/policies/configuration/eventtype/gposettinglockdown.md create mode 100644 docs/threatprevention/8.1/admin/policies/configuration/eventtype/ldapbindmonitoring.md create mode 100644 docs/threatprevention/8.1/admin/policies/configuration/eventtype/ldaplockdown.md create mode 100644 docs/threatprevention/8.1/admin/policies/configuration/eventtype/ldapmonitoring/_category_.json create mode 100644 docs/threatprevention/8.1/admin/policies/configuration/eventtype/ldapmonitoring/ldapmonitoring.md create mode 100644 docs/threatprevention/8.1/admin/policies/configuration/eventtype/ldapmonitoring/ldapping.md create mode 100644 docs/threatprevention/8.1/admin/policies/configuration/eventtype/ldapmonitoring/ldapsearch.md create mode 100644 docs/threatprevention/8.1/admin/policies/configuration/eventtype/ldapmonitoring/threatmanagerldap.md create mode 100644 docs/threatprevention/8.1/admin/policies/configuration/eventtype/lsassguardianmonitor.md create mode 100644 docs/threatprevention/8.1/admin/policies/configuration/eventtype/lsassguardianprotect.md create mode 100644 docs/threatprevention/8.1/admin/policies/configuration/eventtype/overview.md create mode 100644 docs/threatprevention/8.1/admin/policies/configuration/eventtype/passwordenforcement/_category_.json create mode 100644 docs/threatprevention/8.1/admin/policies/configuration/eventtype/passwordenforcement/monitorweakpasswords.md create mode 100644 docs/threatprevention/8.1/admin/policies/configuration/eventtype/passwordenforcement/passwordenforcement.md create mode 100644 docs/threatprevention/8.1/admin/policies/configuration/eventtype/passwordenforcement/preventweakpasswords.md create mode 100644 docs/threatprevention/8.1/admin/policies/configuration/eventtype/window/_category_.json create mode 100644 docs/threatprevention/8.1/admin/policies/configuration/eventtype/window/adcsattributelist.md create mode 100644 docs/threatprevention/8.1/admin/policies/configuration/eventtype/window/addipaddress.md create mode 100644 docs/threatprevention/8.1/admin/policies/configuration/eventtype/window/attributelist.md create mode 100644 docs/threatprevention/8.1/admin/policies/configuration/eventtype/window/classlist.md create mode 100644 docs/threatprevention/8.1/admin/policies/configuration/eventtype/window/context.md create mode 100644 docs/threatprevention/8.1/admin/policies/configuration/eventtype/window/exchangeobjects.md create mode 100644 docs/threatprevention/8.1/admin/policies/configuration/eventtype/window/grouppolicyobjects.md create mode 100644 docs/threatprevention/8.1/admin/policies/configuration/eventtype/window/groups.md create mode 100644 docs/threatprevention/8.1/admin/policies/configuration/eventtype/window/objects.md create mode 100644 docs/threatprevention/8.1/admin/policies/configuration/eventtype/window/overview.md create mode 100644 docs/threatprevention/8.1/admin/policies/configuration/eventtype/window/perpetrators.md create mode 100644 docs/threatprevention/8.1/admin/policies/configuration/eventtype/window/selectcomputers.md create mode 100644 docs/threatprevention/8.1/admin/policies/configuration/eventtype/window/selectdomainsservers.md create mode 100644 docs/threatprevention/8.1/admin/policies/configuration/eventtype/window/selectfilesystemobjects.md create mode 100644 docs/threatprevention/8.1/admin/policies/configuration/eventtype/window/testpasswords.md create mode 100644 docs/threatprevention/8.1/admin/policies/configuration/eventtype/window/trustees.md create mode 100644 docs/threatprevention/8.1/admin/policies/configuration/eventtype/window/useraccountcontrol.md create mode 100644 docs/threatprevention/8.1/admin/policies/configuration/general.md create mode 100644 docs/threatprevention/8.1/admin/policies/configuration/recentevents/_category_.json create mode 100644 docs/threatprevention/8.1/admin/policies/configuration/recentevents/eventtracker.md create mode 100644 docs/threatprevention/8.1/admin/policies/configuration/recentevents/eventviewer.md create mode 100644 docs/threatprevention/8.1/admin/policies/configuration/recentevents/executepsscript.md create mode 100644 docs/threatprevention/8.1/admin/policies/configuration/recentevents/overview.md create mode 100644 docs/threatprevention/8.1/admin/policies/dataprotection.md create mode 100644 docs/threatprevention/8.1/admin/policies/exportpoliciestemplates.md create mode 100644 docs/threatprevention/8.1/admin/policies/overview.md create mode 100644 docs/threatprevention/8.1/admin/tags.md create mode 100644 docs/threatprevention/8.1/admin/templates/_category_.json create mode 100644 docs/threatprevention/8.1/admin/templates/configuration/_category_.json create mode 100644 docs/threatprevention/8.1/admin/templates/configuration/actions.md create mode 100644 docs/threatprevention/8.1/admin/templates/configuration/configuration.md create mode 100644 docs/threatprevention/8.1/admin/templates/configuration/eventtype.md create mode 100644 docs/threatprevention/8.1/admin/templates/configuration/general.md create mode 100644 docs/threatprevention/8.1/admin/templates/createpolicy.md create mode 100644 docs/threatprevention/8.1/admin/templates/folder/_category_.json create mode 100644 docs/threatprevention/8.1/admin/templates/folder/actions/_category_.json create mode 100644 docs/threatprevention/8.1/admin/templates/folder/actions/accountenablement.md create mode 100644 docs/threatprevention/8.1/admin/templates/folder/actions/actions.md create mode 100644 docs/threatprevention/8.1/admin/templates/folder/actions/lockunlockaccount.md create mode 100644 docs/threatprevention/8.1/admin/templates/folder/actions/passwordchanges.md create mode 100644 docs/threatprevention/8.1/admin/templates/folder/actions/passwordneverexpires.md create mode 100644 docs/threatprevention/8.1/admin/templates/folder/actions/passwordrejection.md create mode 100644 docs/threatprevention/8.1/admin/templates/folder/activedirectory.md create mode 100644 docs/threatprevention/8.1/admin/templates/folder/adcs.md create mode 100644 docs/threatprevention/8.1/admin/templates/folder/bestpractices.md create mode 100644 docs/threatprevention/8.1/admin/templates/folder/dns.md create mode 100644 docs/threatprevention/8.1/admin/templates/folder/domainpersistence.md create mode 100644 docs/threatprevention/8.1/admin/templates/folder/exchange.md create mode 100644 docs/threatprevention/8.1/admin/templates/folder/filesystem.md create mode 100644 docs/threatprevention/8.1/admin/templates/folder/grouppolicyobjects.md create mode 100644 docs/threatprevention/8.1/admin/templates/folder/hipaa.md create mode 100644 docs/threatprevention/8.1/admin/templates/folder/ldap.md create mode 100644 docs/threatprevention/8.1/admin/templates/folder/lsass.md create mode 100644 docs/threatprevention/8.1/admin/templates/folder/overview.md create mode 100644 docs/threatprevention/8.1/admin/templates/folder/privilegeescalation.md create mode 100644 docs/threatprevention/8.1/admin/templates/folder/processprotection.md create mode 100644 docs/threatprevention/8.1/admin/templates/folder/ransomware.md create mode 100644 docs/threatprevention/8.1/admin/templates/folder/reconnaissance.md create mode 100644 docs/threatprevention/8.1/admin/templates/folder/schemaconfiguration.md create mode 100644 docs/threatprevention/8.1/admin/templates/folder/siem.md create mode 100644 docs/threatprevention/8.1/admin/templates/folder/threatmanager.md create mode 100644 docs/threatprevention/8.1/admin/templates/overview.md create mode 100644 docs/threatprevention/8.1/admin/tools/_category_.json create mode 100644 docs/threatprevention/8.1/admin/tools/exportpoliciestemplates.md create mode 100644 docs/threatprevention/8.1/admin/tools/import.md create mode 100644 docs/threatprevention/8.1/api/_category_.json create mode 100644 docs/threatprevention/8.1/api/collections.md create mode 100644 docs/threatprevention/8.1/api/epe.md create mode 100644 docs/threatprevention/8.1/api/loadmodule.md create mode 100644 docs/threatprevention/8.1/api/overview.md create mode 100644 docs/threatprevention/8.1/api/policy.md create mode 100644 docs/threatprevention/8.1/api/threatmanager.md create mode 100644 docs/threatprevention/8.1/eperestsite/_category_.json create mode 100644 docs/threatprevention/8.1/eperestsite/accountmanagement.md create mode 100644 docs/threatprevention/8.1/eperestsite/checkpassword.md create mode 100644 docs/threatprevention/8.1/eperestsite/login.md create mode 100644 docs/threatprevention/8.1/eperestsite/overview.md create mode 100644 docs/threatprevention/8.1/gettingstarted.md create mode 100644 docs/threatprevention/8.1/index.md create mode 100644 docs/threatprevention/8.1/install/_category_.json create mode 100644 docs/threatprevention/8.1/install/adminconsole.md create mode 100644 docs/threatprevention/8.1/install/agent/_category_.json create mode 100644 docs/threatprevention/8.1/install/agent/customcert.md create mode 100644 docs/threatprevention/8.1/install/agent/manual.md create mode 100644 docs/threatprevention/8.1/install/agent/overview.md create mode 100644 docs/threatprevention/8.1/install/agent/silent.md create mode 100644 docs/threatprevention/8.1/install/application.md create mode 100644 docs/threatprevention/8.1/install/certificatemanagementwizard.md create mode 100644 docs/threatprevention/8.1/install/dbconnectionmanager.md create mode 100644 docs/threatprevention/8.1/install/eperestsite.md create mode 100644 docs/threatprevention/8.1/install/epeuserfeedback.md create mode 100644 docs/threatprevention/8.1/install/firstlaunch/_category_.json create mode 100644 docs/threatprevention/8.1/install/firstlaunch/firstlaunch.md create mode 100644 docs/threatprevention/8.1/install/firstlaunch/licenseimport.md create mode 100644 docs/threatprevention/8.1/install/migrateemserver.md create mode 100644 docs/threatprevention/8.1/install/overview.md create mode 100644 docs/threatprevention/8.1/install/reportingmodule/_category_.json create mode 100644 docs/threatprevention/8.1/install/reportingmodule/application.md create mode 100644 docs/threatprevention/8.1/install/reportingmodule/database.md create mode 100644 docs/threatprevention/8.1/install/reportingmodule/firstlaunch.md create mode 100644 docs/threatprevention/8.1/install/reportingmodule/overview.md create mode 100644 docs/threatprevention/8.1/install/reportingmodule/secure.md create mode 100644 docs/threatprevention/8.1/install/upgrade/_category_.json create mode 100644 docs/threatprevention/8.1/install/upgrade/agent.md create mode 100644 docs/threatprevention/8.1/install/upgrade/overview.md create mode 100644 docs/threatprevention/8.1/install/upgrade/policytemplates.md create mode 100644 docs/threatprevention/8.1/install/upgrade/reportingmodule.md create mode 100644 docs/threatprevention/8.1/install/upgrade/uninstallagent.md create mode 100644 docs/threatprevention/8.1/reportingmodule/_category_.json create mode 100644 docs/threatprevention/8.1/reportingmodule/configuration/_category_.json create mode 100644 docs/threatprevention/8.1/reportingmodule/configuration/integrations/_category_.json create mode 100644 docs/threatprevention/8.1/reportingmodule/configuration/integrations/activedirectorysync.md create mode 100644 docs/threatprevention/8.1/reportingmodule/configuration/integrations/authenticationprovider/_category_.json create mode 100644 docs/threatprevention/8.1/reportingmodule/configuration/integrations/authenticationprovider/openid.md create mode 100644 docs/threatprevention/8.1/reportingmodule/configuration/integrations/authenticationprovider/page.md create mode 100644 docs/threatprevention/8.1/reportingmodule/configuration/integrations/authenticationprovider/radius.md create mode 100644 docs/threatprevention/8.1/reportingmodule/configuration/integrations/authenticationprovider/saml.md create mode 100644 docs/threatprevention/8.1/reportingmodule/configuration/integrations/credentialprofile.md create mode 100644 docs/threatprevention/8.1/reportingmodule/configuration/integrations/email.md create mode 100644 docs/threatprevention/8.1/reportingmodule/configuration/integrations/foldersettings.md create mode 100644 docs/threatprevention/8.1/reportingmodule/configuration/integrations/netwrixintegrations.md create mode 100644 docs/threatprevention/8.1/reportingmodule/configuration/integrations/overview.md create mode 100644 docs/threatprevention/8.1/reportingmodule/configuration/integrations/tagmanagement.md create mode 100644 docs/threatprevention/8.1/reportingmodule/configuration/overview.md create mode 100644 docs/threatprevention/8.1/reportingmodule/configuration/systemhealth.md create mode 100644 docs/threatprevention/8.1/reportingmodule/configuration/systemsettings/_category_.json create mode 100644 docs/threatprevention/8.1/reportingmodule/configuration/systemsettings/about.md create mode 100644 docs/threatprevention/8.1/reportingmodule/configuration/systemsettings/auditing.md create mode 100644 docs/threatprevention/8.1/reportingmodule/configuration/systemsettings/interface.md create mode 100644 docs/threatprevention/8.1/reportingmodule/configuration/systemsettings/licensing.md create mode 100644 docs/threatprevention/8.1/reportingmodule/configuration/systemsettings/systemjobs.md create mode 100644 docs/threatprevention/8.1/reportingmodule/configuration/systemsettings/useraccess.md create mode 100644 docs/threatprevention/8.1/reportingmodule/investigations/_category_.json create mode 100644 docs/threatprevention/8.1/reportingmodule/investigations/auditcompliance.md create mode 100644 docs/threatprevention/8.1/reportingmodule/investigations/favorites.md create mode 100644 docs/threatprevention/8.1/reportingmodule/investigations/myinvestigations.md create mode 100644 docs/threatprevention/8.1/reportingmodule/investigations/newinvestigation.md create mode 100644 docs/threatprevention/8.1/reportingmodule/investigations/options/_category_.json create mode 100644 docs/threatprevention/8.1/reportingmodule/investigations/options/edit.md create mode 100644 docs/threatprevention/8.1/reportingmodule/investigations/options/export.md create mode 100644 docs/threatprevention/8.1/reportingmodule/investigations/options/filters.md create mode 100644 docs/threatprevention/8.1/reportingmodule/investigations/options/overview.md create mode 100644 docs/threatprevention/8.1/reportingmodule/investigations/options/subscription.md create mode 100644 docs/threatprevention/8.1/reportingmodule/investigations/overview.md create mode 100644 docs/threatprevention/8.1/reportingmodule/investigations/predefinedinvestigations.md create mode 100644 docs/threatprevention/8.1/reportingmodule/investigations/reports/_category_.json create mode 100644 docs/threatprevention/8.1/reportingmodule/investigations/reports/group.md create mode 100644 docs/threatprevention/8.1/reportingmodule/investigations/reports/host.md create mode 100644 docs/threatprevention/8.1/reportingmodule/investigations/reports/reports.md create mode 100644 docs/threatprevention/8.1/reportingmodule/investigations/reports/user.md create mode 100644 docs/threatprevention/8.1/reportingmodule/investigations/subscriptionsexports.md create mode 100644 docs/threatprevention/8.1/reportingmodule/overview.md create mode 100644 docs/threatprevention/8.1/reportingmodule/threats.md create mode 100644 docs/threatprevention/8.1/requirements/_category_.json create mode 100644 docs/threatprevention/8.1/requirements/adminconsole.md create mode 100644 docs/threatprevention/8.1/requirements/agent/_category_.json create mode 100644 docs/threatprevention/8.1/requirements/agent/agent.md create mode 100644 docs/threatprevention/8.1/requirements/agent/agentnas.md create mode 100644 docs/threatprevention/8.1/requirements/application.md create mode 100644 docs/threatprevention/8.1/requirements/eperestsite.md create mode 100644 docs/threatprevention/8.1/requirements/overview.md create mode 100644 docs/threatprevention/8.1/requirements/ports.md create mode 100644 docs/threatprevention/8.1/requirements/reportingserver.md create mode 100644 docs/threatprevention/8.1/requirements/sqlserver/_category_.json create mode 100644 docs/threatprevention/8.1/requirements/sqlserver/dbmaintenance.md create mode 100644 docs/threatprevention/8.1/requirements/sqlserver/sqlserver.md create mode 100644 docs/threatprevention/8.1/siemdashboard/_category_.json create mode 100644 docs/threatprevention/8.1/siemdashboard/activedirectory/_category_.json create mode 100644 docs/threatprevention/8.1/siemdashboard/activedirectory/navigate/_category_.json create mode 100644 docs/threatprevention/8.1/siemdashboard/activedirectory/navigate/activedirectorychanges.md create mode 100644 docs/threatprevention/8.1/siemdashboard/activedirectory/navigate/administratorauditing.md create mode 100644 docs/threatprevention/8.1/siemdashboard/activedirectory/navigate/authenticationattacks.md create mode 100644 docs/threatprevention/8.1/siemdashboard/activedirectory/navigate/gpomonitoring.md create mode 100644 docs/threatprevention/8.1/siemdashboard/activedirectory/navigate/ldap.md create mode 100644 docs/threatprevention/8.1/siemdashboard/activedirectory/navigate/navigate.md create mode 100644 docs/threatprevention/8.1/siemdashboard/activedirectory/navigate/policyreporting.md create mode 100644 docs/threatprevention/8.1/siemdashboard/activedirectory/navigate/userbehavioranalytics.md create mode 100644 docs/threatprevention/8.1/siemdashboard/activedirectory/overview.md create mode 100644 docs/threatprevention/8.1/siemdashboard/overview.md create mode 100644 docs/threatprevention/8.1/siemdashboard/qradar/_category_.json create mode 100644 docs/threatprevention/8.1/siemdashboard/qradar/navigate/_category_.json create mode 100644 docs/threatprevention/8.1/siemdashboard/qradar/navigate/about.md create mode 100644 docs/threatprevention/8.1/siemdashboard/qradar/navigate/adchanges.md create mode 100644 docs/threatprevention/8.1/siemdashboard/qradar/navigate/administratorauditing.md create mode 100644 docs/threatprevention/8.1/siemdashboard/qradar/navigate/authenticationattacks.md create mode 100644 docs/threatprevention/8.1/siemdashboard/qradar/navigate/gpomonitoring.md create mode 100644 docs/threatprevention/8.1/siemdashboard/qradar/navigate/hostinvestigation.md create mode 100644 docs/threatprevention/8.1/siemdashboard/qradar/navigate/ldap.md create mode 100644 docs/threatprevention/8.1/siemdashboard/qradar/navigate/navigate.md create mode 100644 docs/threatprevention/8.1/siemdashboard/qradar/navigate/overview.md create mode 100644 docs/threatprevention/8.1/siemdashboard/qradar/navigate/policyreporting.md create mode 100644 docs/threatprevention/8.1/siemdashboard/qradar/navigate/settings.md create mode 100644 docs/threatprevention/8.1/siemdashboard/qradar/navigate/userinvestigation.md create mode 100644 docs/threatprevention/8.1/siemdashboard/qradar/offenses.md create mode 100644 docs/threatprevention/8.1/siemdashboard/qradar/overview.md create mode 100644 docs/threatprevention/8.1/siemdashboard/qradar/qidmap.md create mode 100644 docs/threatprevention/8.1/siemdashboard/threathunting/_category_.json create mode 100644 docs/threatprevention/8.1/siemdashboard/threathunting/navigate/_category_.json create mode 100644 docs/threatprevention/8.1/siemdashboard/threathunting/navigate/navigate.md create mode 100644 docs/threatprevention/8.1/siemdashboard/threathunting/navigate/perpetratorhunting.md create mode 100644 docs/threatprevention/8.1/siemdashboard/threathunting/navigate/privilegecreepescalation.md create mode 100644 docs/threatprevention/8.1/siemdashboard/threathunting/navigate/sensitivedatahunting.md create mode 100644 docs/threatprevention/8.1/siemdashboard/threathunting/overview.md create mode 100644 docs/threatprevention/8.1/solutions/_category_.json create mode 100644 docs/threatprevention/8.1/solutions/activedirectory.md create mode 100644 docs/threatprevention/8.1/solutions/epe.md create mode 100644 docs/threatprevention/8.1/solutions/exchange.md create mode 100644 docs/threatprevention/8.1/solutions/filesystem.md create mode 100644 docs/threatprevention/8.1/solutions/ldap.md create mode 100644 docs/threatprevention/8.1/solutions/overview.md create mode 100644 docs/threatprevention/8.1/troubleshooting/_category_.json create mode 100644 docs/threatprevention/8.1/troubleshooting/agentcommunication.md create mode 100644 docs/threatprevention/8.1/troubleshooting/agentservice.md create mode 100644 docs/threatprevention/8.1/troubleshooting/enterprisemanagercommunication.md create mode 100644 docs/threatprevention/8.1/troubleshooting/exchangelockdown.md create mode 100644 docs/threatprevention/8.1/troubleshooting/lsass.md create mode 100644 docs/threatprevention/8.1/troubleshooting/msilogs.md create mode 100644 docs/threatprevention/8.1/troubleshooting/overview.md create mode 100644 docs/threatprevention/8.1/troubleshooting/sqlserver.md create mode 100644 sidebars/threatprevention/8.1.js create mode 100644 static/images/threatprevention/8.1/admin/agents/adpendingmodealert.webp create mode 100644 static/images/threatprevention/8.1/admin/agents/agentsinterface.webp create mode 100644 static/images/threatprevention/8.1/admin/agents/agentstatuses.webp create mode 100644 static/images/threatprevention/8.1/admin/agents/autodeployicon.webp create mode 100644 static/images/threatprevention/8.1/admin/agents/deploy/addfromad.webp create mode 100644 static/images/threatprevention/8.1/admin/agents/deploy/addfromfile.webp create mode 100644 static/images/threatprevention/8.1/admin/agents/deploy/installing.webp create mode 100644 static/images/threatprevention/8.1/admin/agents/deploy/installpath.webp create mode 100644 static/images/threatprevention/8.1/admin/agents/deploy/prerequisitescheck.webp create mode 100644 static/images/threatprevention/8.1/admin/agents/deploy/selectcomputers.webp create mode 100644 static/images/threatprevention/8.1/admin/agents/deploy/setoptions.webp create mode 100644 static/images/threatprevention/8.1/admin/agents/deploy/updatesetoptions.webp create mode 100644 static/images/threatprevention/8.1/admin/agents/deployagent.webp create mode 100644 static/images/threatprevention/8.1/admin/agents/enrollmentsecreticon.webp create mode 100644 static/images/threatprevention/8.1/admin/agents/exporticon.webp create mode 100644 static/images/threatprevention/8.1/admin/agents/getagentlogicon.webp create mode 100644 static/images/threatprevention/8.1/admin/agents/refreshicon.webp create mode 100644 static/images/threatprevention/8.1/admin/agents/rightclickmenu.webp create mode 100644 static/images/threatprevention/8.1/admin/agents/updateinstallericon.webp create mode 100644 static/images/threatprevention/8.1/admin/agents/updateloggingicon.webp create mode 100644 static/images/threatprevention/8.1/admin/agents/warningsymbol.webp create mode 100644 static/images/threatprevention/8.1/admin/agents/window/agentversionmismatch.webp create mode 100644 static/images/threatprevention/8.1/admin/agents/window/autodeploy.webp create mode 100644 static/images/threatprevention/8.1/admin/agents/window/checkfornewversion.webp create mode 100644 static/images/threatprevention/8.1/admin/agents/window/consolelogs.webp create mode 100644 static/images/threatprevention/8.1/admin/agents/window/emlogs.webp create mode 100644 static/images/threatprevention/8.1/admin/agents/window/enrollmentsecret.webp create mode 100644 static/images/threatprevention/8.1/admin/agents/window/getagentlog.webp create mode 100644 static/images/threatprevention/8.1/admin/agents/window/loglevelconfiguration.webp create mode 100644 static/images/threatprevention/8.1/admin/agents/window/saveaswindow.webp create mode 100644 static/images/threatprevention/8.1/admin/agents/window/uptodate.webp create mode 100644 static/images/threatprevention/8.1/admin/alerts/alertsinterface.webp create mode 100644 static/images/threatprevention/8.1/admin/alerts/window/alertscleanup.webp create mode 100644 static/images/threatprevention/8.1/admin/alerts/window/export.webp create mode 100644 static/images/threatprevention/8.1/admin/alerts/window/policycomparison.webp create mode 100644 static/images/threatprevention/8.1/admin/analytics/accounthackingsettings.webp create mode 100644 static/images/threatprevention/8.1/admin/analytics/analyticsinterface.webp create mode 100644 static/images/threatprevention/8.1/admin/analytics/analyticslist.webp create mode 100644 static/images/threatprevention/8.1/admin/analytics/baduseridsettings.webp create mode 100644 static/images/threatprevention/8.1/admin/analytics/baduseridsourcehost.webp create mode 100644 static/images/threatprevention/8.1/admin/analytics/baduseriduser.webp create mode 100644 static/images/threatprevention/8.1/admin/analytics/breachedpassword.webp create mode 100644 static/images/threatprevention/8.1/admin/analytics/breachedpasswordsettings.webp create mode 100644 static/images/threatprevention/8.1/admin/analytics/bruteforce.webp create mode 100644 static/images/threatprevention/8.1/admin/analytics/bruteforceattackssettings.webp create mode 100644 static/images/threatprevention/8.1/admin/analytics/concurrentlogins.webp create mode 100644 static/images/threatprevention/8.1/admin/analytics/concurrentloginssettings.webp create mode 100644 static/images/threatprevention/8.1/admin/analytics/filesystemattackssettings.webp create mode 100644 static/images/threatprevention/8.1/admin/analytics/forgedpac.webp create mode 100644 static/images/threatprevention/8.1/admin/analytics/forgedpacsettings.webp create mode 100644 static/images/threatprevention/8.1/admin/analytics/fsattacks.webp create mode 100644 static/images/threatprevention/8.1/admin/analytics/goldenticket.webp create mode 100644 static/images/threatprevention/8.1/admin/analytics/goldenticketsettings.webp create mode 100644 static/images/threatprevention/8.1/admin/analytics/horizontalattackssettings.webp create mode 100644 static/images/threatprevention/8.1/admin/analytics/horizontalmovement.webp create mode 100644 static/images/threatprevention/8.1/admin/analytics/impersonationlogins.webp create mode 100644 static/images/threatprevention/8.1/admin/analytics/kerberosweakencryption.webp create mode 100644 static/images/threatprevention/8.1/admin/analytics/policytab.webp create mode 100644 static/images/threatprevention/8.1/admin/analytics/policytabfsmonitoring.webp create mode 100644 static/images/threatprevention/8.1/admin/analytics/policytabfsmonitoringlockdown.webp create mode 100644 static/images/threatprevention/8.1/admin/analytics/useraccounthacking.webp create mode 100644 static/images/threatprevention/8.1/admin/configuration/collectionmanager/addcollectionoptions.webp create mode 100644 static/images/threatprevention/8.1/admin/configuration/collectionmanager/addnewcollection.webp create mode 100644 static/images/threatprevention/8.1/admin/configuration/collectionmanager/collectionmanager.webp create mode 100644 static/images/threatprevention/8.1/admin/configuration/collectionmanager/confirmremoval.webp create mode 100644 static/images/threatprevention/8.1/admin/configuration/collectionmanager/dependencies.webp create mode 100644 static/images/threatprevention/8.1/admin/configuration/collectionmanager/editcollection.webp create mode 100644 static/images/threatprevention/8.1/admin/configuration/collectionmanager/expandgroups.webp create mode 100644 static/images/threatprevention/8.1/admin/configuration/collectionmanager/listofcollections.webp create mode 100644 static/images/threatprevention/8.1/admin/configuration/collectionmanager/selectadobjects.webp create mode 100644 static/images/threatprevention/8.1/admin/configuration/custommessageseditor.webp create mode 100644 static/images/threatprevention/8.1/admin/configuration/databasemaintenance/analytics.webp create mode 100644 static/images/threatprevention/8.1/admin/configuration/databasemaintenance/archivedb.webp create mode 100644 static/images/threatprevention/8.1/admin/configuration/databasemaintenance/archivedbmaintenance.webp create mode 100644 static/images/threatprevention/8.1/admin/configuration/databasemaintenance/databasemaintenance.webp create mode 100644 static/images/threatprevention/8.1/admin/configuration/databasemaintenance/dbmaintenancejob.webp create mode 100644 static/images/threatprevention/8.1/admin/configuration/databasemaintenance/enablesettings.webp create mode 100644 static/images/threatprevention/8.1/admin/configuration/databasemaintenance/eventtype.webp create mode 100644 static/images/threatprevention/8.1/admin/configuration/databasemaintenance/policy.webp create mode 100644 static/images/threatprevention/8.1/admin/configuration/databasemaintenance/schedule.webp create mode 100644 static/images/threatprevention/8.1/admin/configuration/databasemaintenance/warning.webp create mode 100644 static/images/threatprevention/8.1/admin/configuration/editcollectionaccounts.webp create mode 100644 static/images/threatprevention/8.1/admin/configuration/editcollectionaccounts_1.webp create mode 100644 static/images/threatprevention/8.1/admin/configuration/editcollectionhosts.webp create mode 100644 static/images/threatprevention/8.1/admin/configuration/editcollectionmachineaccounts.webp create mode 100644 static/images/threatprevention/8.1/admin/configuration/editcollectionprocesses.webp create mode 100644 static/images/threatprevention/8.1/admin/configuration/epesettings.webp create mode 100644 static/images/threatprevention/8.1/admin/configuration/eventfiltering.webp create mode 100644 static/images/threatprevention/8.1/admin/configuration/eventsdatabaseconfig.webp create mode 100644 static/images/threatprevention/8.1/admin/configuration/filemonitorsettings.webp create mode 100644 static/images/threatprevention/8.1/admin/configuration/forgedpac.webp create mode 100644 static/images/threatprevention/8.1/admin/configuration/hibp_installation_0.webp create mode 100644 static/images/threatprevention/8.1/admin/configuration/hibp_installation_1.webp create mode 100644 static/images/threatprevention/8.1/admin/configuration/hibp_installation_3.webp create mode 100644 static/images/threatprevention/8.1/admin/configuration/honeytoken.webp create mode 100644 static/images/threatprevention/8.1/admin/configuration/passworddictionary.webp create mode 100644 static/images/threatprevention/8.1/admin/configuration/rules.webp create mode 100644 static/images/threatprevention/8.1/admin/configuration/siemoutputviewer.webp create mode 100644 static/images/threatprevention/8.1/admin/configuration/substitutioneditor.webp create mode 100644 static/images/threatprevention/8.1/admin/configuration/systemalerting/emailtemplate.webp create mode 100644 static/images/threatprevention/8.1/admin/configuration/systemalerting/eventlog.webp create mode 100644 static/images/threatprevention/8.1/admin/configuration/systemalerting/geariconformappingfile.webp create mode 100644 static/images/threatprevention/8.1/admin/configuration/systemalerting/importfile.webp create mode 100644 static/images/threatprevention/8.1/admin/configuration/systemalerting/seim.webp create mode 100644 static/images/threatprevention/8.1/admin/configuration/systemalerting/seimserver.webp create mode 100644 static/images/threatprevention/8.1/admin/configuration/systemalerting/siemtemplates.webp create mode 100644 static/images/threatprevention/8.1/admin/configuration/systemalerting/smtphost.webp create mode 100644 static/images/threatprevention/8.1/admin/configuration/systemalerting/systemalerting.webp create mode 100644 static/images/threatprevention/8.1/admin/configuration/threatmanagerconfiguration.webp create mode 100644 static/images/threatprevention/8.1/admin/configuration/userroles/addbutton.webp create mode 100644 static/images/threatprevention/8.1/admin/configuration/userroles/featuresbutton.webp create mode 100644 static/images/threatprevention/8.1/admin/configuration/userroles/removeuser.webp create mode 100644 static/images/threatprevention/8.1/admin/configuration/userroles/selectusersorgroups.webp create mode 100644 static/images/threatprevention/8.1/admin/configuration/userroles/usersroleswindow.webp create mode 100644 static/images/threatprevention/8.1/admin/configuration/wordslistdictionary.webp create mode 100644 static/images/threatprevention/8.1/admin/investigate/attributes.webp create mode 100644 static/images/threatprevention/8.1/admin/investigate/datagrid.webp create mode 100644 static/images/threatprevention/8.1/admin/investigate/filtercategories.webp create mode 100644 static/images/threatprevention/8.1/admin/investigate/filtersetname.webp create mode 100644 static/images/threatprevention/8.1/admin/investigate/investigateinterface.webp create mode 100644 static/images/threatprevention/8.1/admin/investigate/parameter.webp create mode 100644 static/images/threatprevention/8.1/admin/investigate/savedview.webp create mode 100644 static/images/threatprevention/8.1/admin/investigate/saveview.webp create mode 100644 static/images/threatprevention/8.1/admin/investigate/summaryfolders.webp create mode 100644 static/images/threatprevention/8.1/admin/investigate/summaryreport.webp create mode 100644 static/images/threatprevention/8.1/admin/navigation/adminconsole.webp create mode 100644 static/images/threatprevention/8.1/admin/navigation/agentsmenu.webp create mode 100644 static/images/threatprevention/8.1/admin/navigation/customization.webp create mode 100644 static/images/threatprevention/8.1/admin/navigation/datagridfunctionality.webp create mode 100644 static/images/threatprevention/8.1/admin/navigation/export.webp create mode 100644 static/images/threatprevention/8.1/admin/navigation/filterdata.webp create mode 100644 static/images/threatprevention/8.1/admin/navigation/filtereditor.webp create mode 100644 static/images/threatprevention/8.1/admin/navigation/foldermenu.webp create mode 100644 static/images/threatprevention/8.1/admin/navigation/headerrightclickmenu.webp create mode 100644 static/images/threatprevention/8.1/admin/navigation/individualpolicytemplatenode.webp create mode 100644 static/images/threatprevention/8.1/admin/navigation/licensemanager.webp create mode 100644 static/images/threatprevention/8.1/admin/navigation/menu.webp create mode 100644 static/images/threatprevention/8.1/admin/navigation/policiestemplatesnodes.webp create mode 100644 static/images/threatprevention/8.1/admin/navigation/policycenter.webp create mode 100644 static/images/threatprevention/8.1/admin/navigation/savedinvestigateviewnode.webp create mode 100644 static/images/threatprevention/8.1/admin/navigation/searchfunction.webp create mode 100644 static/images/threatprevention/8.1/admin/navigation/searchresults.webp create mode 100644 static/images/threatprevention/8.1/admin/navigation/sortdatafunction.webp create mode 100644 static/images/threatprevention/8.1/admin/navigation/statusbar.webp create mode 100644 static/images/threatprevention/8.1/admin/navigation/tagsnode.webp create mode 100644 static/images/threatprevention/8.1/admin/navigation/templatenodeundertags.webp create mode 100644 static/images/threatprevention/8.1/admin/navigation/valuesfilter.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/actions/actionsconfigurationsarea.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/actions/actionstab.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/actions/addactionwindow.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/actions/addactionwindowfornetscript.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/actions/addactionwindowforpowershell.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/actions/emailnotificationssetup.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/actions/fileaction.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/actions/netscriptaction.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/actions/powershellaction.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/actions/scripteditorfornet.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/actions/scripteditorforps.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/actions/toolsmenu.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/adcontexts.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/alwaysactivebutton.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/enableddisabledpolicies.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/adaccount.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/adattributes.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/adattributesmonitor.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/adchanges.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/adclasses.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/adclassesattributes.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/adcontext.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/adcsattributes.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/adcslockdown.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/adcslockdownattributes.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/adcsmonitoring.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/additionalagents.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/adevent.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/adgrouppolicyobject.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/adgrouppolicyobjectchanges.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/adgroups.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/adlockdown.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/adobjects.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/adobjectsandcontainers.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/adperpetratormonitoring.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/adperpetratorprotect.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/adreadmonitoring.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/adreplicationhostsfrom.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/adreplicationlockdown.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/adreplicationmonitoring.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/advancedadchanges.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/advancedgpo.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/authenticationlockdown.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/authenticationmonitoring.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/authenticationprotocollockdown.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/authenticationprotocolmonitoring.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/bindprotocol.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/domainsserversmonitoring.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/effectivegroupmembership.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/eventselection.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/eventtypetab.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/exchangechanges.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/exchangeevent.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/exchangeeventlockdown.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/exchangelockdown.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/exchangemailboxobjectsandcontainers.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/exchangeperpetrator.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/exchangeperpetratorlockdown.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/exchangetrustees.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/exchangetrusteeslockdown.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/filesystem.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/filesystemaccessanalyzer.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/filesystemaccessanalyzer_1.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/filesystemagents.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/filesystemchanges.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/filesystemlockdown.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/filesystemlockdown_1.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/filterstatement.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/fsmooperations.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/fsmorolemonitoring.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/fsmoroles.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/ggposettinglockdown.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/gpo.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/gposettingchanges.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/hostsfrom.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/hostsfromlockdown.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/hoststo.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/hoststolockdown.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/ipaddressesfrom.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/ipaddressesto.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/ldap.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/ldapattributes.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/ldapbind.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/ldapbindmonitor.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/ldaplockdown.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/ldapmonitoring.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/ldapquery.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/ldapquerylockdown.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/ldapruntime.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/lsassmonitor.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/lsassprotect.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/openprocessflagsmonitoring.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/passwordenforcement.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/passwordrules.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/paths.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/permissions.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/perpetratorstoexclude.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/processesandconfiguration.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/processesmonitoring.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/processesprotect.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/queryresult.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/rulepreview.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/subfolder.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/subtree.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/success.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/targetprocesseslockdown.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/targetprocessesmonitoring.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/usecase/honeytoken.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/usecase/invesitgatenodeblock.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/usecase/invesitgatenodemonitor.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/usecase/ldapfiltercopiedtoclipboard.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/usecase/ldapmonitoringfortm.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/usecase/ldapping.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/usecase/ldapsearchscopes.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/usecase/newblockepepolicy.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/usecase/newmonitorepepolicy.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/usecase/passwordrulesblock.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/usecase/passwordrulesmonitor.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/usecase/recenteventsmonitor.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/usecase/recenteventsprevent.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/useraccountcontrol.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/window/adcsattributelist.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/window/addipaddress.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/window/adperpetrators.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/window/attributelist.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/window/classlist.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/window/filesystemobjects.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/window/filesystemobjectsnas.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/window/passwordtestfailed.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/window/passwordtestpassed.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/window/searchmode.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/window/selectactivedirectory/adgpo.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/window/selectactivedirectory/adgroups.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/window/selectactivedirectory/adobjects.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/window/selectactivedirectory/adtrustees.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/window/selectactivedirectory/exchangeobjectsfromad.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/window/selectagent.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/window/selectcomputers.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/window/selectdomainsservers.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/window/testpasswords.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/window/useraccountcontrolattribute.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/eventtype/window/useraccountcotrol.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/export.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/generaltab.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/history.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/permissions.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/policiesinterface.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/policyrightclickkmenu.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/recentevents/eventtracker.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/recentevents/eventviewer.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/recentevents/recenteventdetails.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/recentevents/recenteventstab.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/recentevents/rightclickmenu.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/schedule.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/schedulespecifictimes.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/selectuser.webp create mode 100644 static/images/threatprevention/8.1/admin/policies/specifictimesbutton.webp create mode 100644 static/images/threatprevention/8.1/admin/systemdiagram.webp create mode 100644 static/images/threatprevention/8.1/admin/tags/tags.webp create mode 100644 static/images/threatprevention/8.1/admin/templates/actionstab.webp create mode 100644 static/images/threatprevention/8.1/admin/templates/eventtypetab.webp create mode 100644 static/images/threatprevention/8.1/admin/templates/generaltab.webp create mode 100644 static/images/threatprevention/8.1/admin/templates/import.webp create mode 100644 static/images/threatprevention/8.1/admin/templates/rightclickmenu.webp create mode 100644 static/images/threatprevention/8.1/admin/templates/templates.webp create mode 100644 static/images/threatprevention/8.1/admin/tools/exportpoliciestemplates.webp create mode 100644 static/images/threatprevention/8.1/admin/tools/import.webp create mode 100644 static/images/threatprevention/8.1/eperestsite/basic.webp create mode 100644 static/images/threatprevention/8.1/eperestsite/bearer.webp create mode 100644 static/images/threatprevention/8.1/eperestsite/create.webp create mode 100644 static/images/threatprevention/8.1/eperestsite/delete.webp create mode 100644 static/images/threatprevention/8.1/eperestsite/digest.webp create mode 100644 static/images/threatprevention/8.1/eperestsite/login.webp create mode 100644 static/images/threatprevention/8.1/eperestsite/logoff.webp create mode 100644 static/images/threatprevention/8.1/eperestsite/token.webp create mode 100644 static/images/threatprevention/8.1/eperestsite/userid.webp create mode 100644 static/images/threatprevention/8.1/eperestsite/username.webp create mode 100644 static/images/threatprevention/8.1/eperestsite/users.webp create mode 100644 static/images/threatprevention/8.1/install/agent/cacertconfig.webp create mode 100644 static/images/threatprevention/8.1/install/agent/certificates.webp create mode 100644 static/images/threatprevention/8.1/install/agent/changedestination.webp create mode 100644 static/images/threatprevention/8.1/install/agent/destinationfolder.webp create mode 100644 static/images/threatprevention/8.1/install/agent/enterprisemanager.webp create mode 100644 static/images/threatprevention/8.1/install/agent/eventsources.webp create mode 100644 static/images/threatprevention/8.1/install/agent/license.webp create mode 100644 static/images/threatprevention/8.1/install/agent/readytoinstall.webp create mode 100644 static/images/threatprevention/8.1/install/agent/success.webp create mode 100644 static/images/threatprevention/8.1/install/agent/welcome.webp create mode 100644 static/images/threatprevention/8.1/install/agent/welcome2.webp create mode 100644 static/images/threatprevention/8.1/install/certificatesimported.webp create mode 100644 static/images/threatprevention/8.1/install/changedestinationfolder.webp create mode 100644 static/images/threatprevention/8.1/install/complete.webp create mode 100644 static/images/threatprevention/8.1/install/csrfilescreated.webp create mode 100644 static/images/threatprevention/8.1/install/customsetup.webp create mode 100644 static/images/threatprevention/8.1/install/customsetup_1.webp create mode 100644 static/images/threatprevention/8.1/install/database.webp create mode 100644 static/images/threatprevention/8.1/install/databselogininfor.webp create mode 100644 static/images/threatprevention/8.1/install/dbconnectionmanager.webp create mode 100644 static/images/threatprevention/8.1/install/desktopicon.webp create mode 100644 static/images/threatprevention/8.1/install/emlocationforremoteconsole.webp create mode 100644 static/images/threatprevention/8.1/install/emlocationinfo.webp create mode 100644 static/images/threatprevention/8.1/install/exportcertificate.webp create mode 100644 static/images/threatprevention/8.1/install/grouppolicymanagementconsole.webp create mode 100644 static/images/threatprevention/8.1/install/grouppolicymanagementeditor.webp create mode 100644 static/images/threatprevention/8.1/install/importcertificateauthority.webp create mode 100644 static/images/threatprevention/8.1/install/importlicense.webp create mode 100644 static/images/threatprevention/8.1/install/importsignedcertificates.webp create mode 100644 static/images/threatprevention/8.1/install/importtemplates.webp create mode 100644 static/images/threatprevention/8.1/install/installagent.webp create mode 100644 static/images/threatprevention/8.1/install/installnet.webp create mode 100644 static/images/threatprevention/8.1/install/licenseagreement.webp create mode 100644 static/images/threatprevention/8.1/install/logon.webp create mode 100644 static/images/threatprevention/8.1/install/netrequired.webp create mode 100644 static/images/threatprevention/8.1/install/readytoinstall.webp create mode 100644 static/images/threatprevention/8.1/install/reportingmodule/applicationcheck.webp create mode 100644 static/images/threatprevention/8.1/install/reportingmodule/builtinadminpassword.webp create mode 100644 static/images/threatprevention/8.1/install/reportingmodule/completed.webp create mode 100644 static/images/threatprevention/8.1/install/reportingmodule/completed_1.webp create mode 100644 static/images/threatprevention/8.1/install/reportingmodule/database.webp create mode 100644 static/images/threatprevention/8.1/install/reportingmodule/databasecreatemessage.webp create mode 100644 static/images/threatprevention/8.1/install/reportingmodule/databaseready.webp create mode 100644 static/images/threatprevention/8.1/install/reportingmodule/desktopicon.webp create mode 100644 static/images/threatprevention/8.1/install/reportingmodule/eula.webp create mode 100644 static/images/threatprevention/8.1/install/reportingmodule/eula_1.webp create mode 100644 static/images/threatprevention/8.1/install/reportingmodule/firewallrules.webp create mode 100644 static/images/threatprevention/8.1/install/reportingmodule/folder.webp create mode 100644 static/images/threatprevention/8.1/install/reportingmodule/folder_1.webp create mode 100644 static/images/threatprevention/8.1/install/reportingmodule/install.webp create mode 100644 static/images/threatprevention/8.1/install/reportingmodule/postgresqlcheck.webp create mode 100644 static/images/threatprevention/8.1/install/reportingmodule/registerauthenticator.webp create mode 100644 static/images/threatprevention/8.1/install/reportingmodule/setuplauncher.webp create mode 100644 static/images/threatprevention/8.1/install/selectaction.webp create mode 100644 static/images/threatprevention/8.1/install/selectactioncomplete.webp create mode 100644 static/images/threatprevention/8.1/install/selectcomponents.webp create mode 100644 static/images/threatprevention/8.1/install/upgrade/accessverification.webp create mode 100644 static/images/threatprevention/8.1/install/upgrade/entercredentials.webp create mode 100644 static/images/threatprevention/8.1/install/upgrade/eula.webp create mode 100644 static/images/threatprevention/8.1/install/upgrade/install.webp create mode 100644 static/images/threatprevention/8.1/install/upgrade/install_1.webp create mode 100644 static/images/threatprevention/8.1/install/upgrade/tm3installation.webp create mode 100644 static/images/threatprevention/8.1/install/upgrade/upgradeagent.webp create mode 100644 static/images/threatprevention/8.1/install/upgrade/upgradeappprompt.webp create mode 100644 static/images/threatprevention/8.1/install/upgrade/upgradedbprompt.webp create mode 100644 static/images/threatprevention/8.1/install/welcome.webp create mode 100644 static/images/threatprevention/8.1/install/winconsoleicon.webp create mode 100644 static/images/threatprevention/8.1/install/windowsauthentication.webp create mode 100644 static/images/threatprevention/8.1/reportingmodule/configuration/integrations/activedirectorysync.webp create mode 100644 static/images/threatprevention/8.1/reportingmodule/configuration/integrations/additionaloptions.webp create mode 100644 static/images/threatprevention/8.1/reportingmodule/configuration/integrations/addnewintegration.webp create mode 100644 static/images/threatprevention/8.1/reportingmodule/configuration/integrations/addnewsharedfolderwindow.webp create mode 100644 static/images/threatprevention/8.1/reportingmodule/configuration/integrations/authenticationprovider/authenticationprovider.webp create mode 100644 static/images/threatprevention/8.1/reportingmodule/configuration/integrations/authenticationprovider/configurationopenid.webp create mode 100644 static/images/threatprevention/8.1/reportingmodule/configuration/integrations/authenticationprovider/configurationradius.webp create mode 100644 static/images/threatprevention/8.1/reportingmodule/configuration/integrations/authenticationprovider/configurationsaml.webp create mode 100644 static/images/threatprevention/8.1/reportingmodule/configuration/integrations/authenticationprovider/customizationtab.webp create mode 100644 static/images/threatprevention/8.1/reportingmodule/configuration/integrations/authenticationprovider/openid.webp create mode 100644 static/images/threatprevention/8.1/reportingmodule/configuration/integrations/authenticationprovider/page.webp create mode 100644 static/images/threatprevention/8.1/reportingmodule/configuration/integrations/authenticationprovider/radius.webp create mode 100644 static/images/threatprevention/8.1/reportingmodule/configuration/integrations/authenticationprovider/saml.webp create mode 100644 static/images/threatprevention/8.1/reportingmodule/configuration/integrations/authenticationprovider/type.webp create mode 100644 static/images/threatprevention/8.1/reportingmodule/configuration/integrations/authenticationprovider/usersgroupstab.webp create mode 100644 static/images/threatprevention/8.1/reportingmodule/configuration/integrations/configurationtab.webp create mode 100644 static/images/threatprevention/8.1/reportingmodule/configuration/integrations/credentialprofile.webp create mode 100644 static/images/threatprevention/8.1/reportingmodule/configuration/integrations/credentialsettingswindow.webp create mode 100644 static/images/threatprevention/8.1/reportingmodule/configuration/integrations/details.webp create mode 100644 static/images/threatprevention/8.1/reportingmodule/configuration/integrations/details_1.webp create mode 100644 static/images/threatprevention/8.1/reportingmodule/configuration/integrations/details_2.webp create mode 100644 static/images/threatprevention/8.1/reportingmodule/configuration/integrations/details_3.webp create mode 100644 static/images/threatprevention/8.1/reportingmodule/configuration/integrations/details_4.webp create mode 100644 static/images/threatprevention/8.1/reportingmodule/configuration/integrations/domainconfigurationtab.webp create mode 100644 static/images/threatprevention/8.1/reportingmodule/configuration/integrations/editnetwrixintegration.webp create mode 100644 static/images/threatprevention/8.1/reportingmodule/configuration/integrations/editprofile.webp create mode 100644 static/images/threatprevention/8.1/reportingmodule/configuration/integrations/interface.webp create mode 100644 static/images/threatprevention/8.1/reportingmodule/configuration/integrations/localfolder.webp create mode 100644 static/images/threatprevention/8.1/reportingmodule/configuration/integrations/page.webp create mode 100644 static/images/threatprevention/8.1/reportingmodule/configuration/integrations/page_1.webp create mode 100644 static/images/threatprevention/8.1/reportingmodule/configuration/integrations/page_2.webp create mode 100644 static/images/threatprevention/8.1/reportingmodule/configuration/integrations/page_3.webp create mode 100644 static/images/threatprevention/8.1/reportingmodule/configuration/integrations/page_4.webp create mode 100644 static/images/threatprevention/8.1/reportingmodule/configuration/integrations/page_5.webp create mode 100644 static/images/threatprevention/8.1/reportingmodule/configuration/integrations/policysynctab.webp create mode 100644 static/images/threatprevention/8.1/reportingmodule/configuration/integrations/search.webp create mode 100644 static/images/threatprevention/8.1/reportingmodule/configuration/integrations/searchselect.webp create mode 100644 static/images/threatprevention/8.1/reportingmodule/configuration/integrations/sharedfoldertable.webp create mode 100644 static/images/threatprevention/8.1/reportingmodule/configuration/integrations/synchistorytab.webp create mode 100644 static/images/threatprevention/8.1/reportingmodule/configuration/integrations/tagmanagement.webp create mode 100644 static/images/threatprevention/8.1/reportingmodule/configuration/integrations/typefilters.webp create mode 100644 static/images/threatprevention/8.1/reportingmodule/configuration/menu.webp create mode 100644 static/images/threatprevention/8.1/reportingmodule/configuration/servicesdetails.webp create mode 100644 static/images/threatprevention/8.1/reportingmodule/configuration/servicespage.webp create mode 100644 static/images/threatprevention/8.1/reportingmodule/configuration/systemsettings/about.webp create mode 100644 static/images/threatprevention/8.1/reportingmodule/configuration/systemsettings/addconsoleaccess.webp create mode 100644 static/images/threatprevention/8.1/reportingmodule/configuration/systemsettings/editaccess.webp create mode 100644 static/images/threatprevention/8.1/reportingmodule/configuration/systemsettings/editpasswordbuiltinadmin.webp create mode 100644 static/images/threatprevention/8.1/reportingmodule/configuration/systemsettings/interface.webp create mode 100644 static/images/threatprevention/8.1/reportingmodule/configuration/systemsettings/licensing.webp create mode 100644 static/images/threatprevention/8.1/reportingmodule/configuration/systemsettings/page.webp create mode 100644 static/images/threatprevention/8.1/reportingmodule/configuration/systemsettings/reporthealth.webp create mode 100644 static/images/threatprevention/8.1/reportingmodule/configuration/systemsettings/reportsettings.webp create mode 100644 static/images/threatprevention/8.1/reportingmodule/configuration/systemsettings/settings.webp create mode 100644 static/images/threatprevention/8.1/reportingmodule/configuration/systemsettings/useraccess.webp create mode 100644 static/images/threatprevention/8.1/reportingmodule/configuration/systemsettings/usersgroups.webp create mode 100644 static/images/threatprevention/8.1/reportingmodule/interface.webp create mode 100644 static/images/threatprevention/8.1/reportingmodule/investigations/auditcompliance.webp create mode 100644 static/images/threatprevention/8.1/reportingmodule/investigations/eventdetails.webp create mode 100644 static/images/threatprevention/8.1/reportingmodule/investigations/eventsovertime.webp create mode 100644 static/images/threatprevention/8.1/reportingmodule/investigations/favorites.webp create mode 100644 static/images/threatprevention/8.1/reportingmodule/investigations/favoriteselectedtm.webp create mode 100644 static/images/threatprevention/8.1/reportingmodule/investigations/filterwindow.webp create mode 100644 static/images/threatprevention/8.1/reportingmodule/investigations/groupdetails.webp create mode 100644 static/images/threatprevention/8.1/reportingmodule/investigations/groupmembershiptab.webp create mode 100644 static/images/threatprevention/8.1/reportingmodule/investigations/hostdetails.webp create mode 100644 static/images/threatprevention/8.1/reportingmodule/investigations/myinvestigations.webp create mode 100644 static/images/threatprevention/8.1/reportingmodule/investigations/newinvestigation.webp create mode 100644 static/images/threatprevention/8.1/reportingmodule/investigations/options/attrributemenu.webp create mode 100644 static/images/threatprevention/8.1/reportingmodule/investigations/options/editinvestigationtm.webp create mode 100644 static/images/threatprevention/8.1/reportingmodule/investigations/options/export.webp create mode 100644 static/images/threatprevention/8.1/reportingmodule/investigations/options/filters.webp create mode 100644 static/images/threatprevention/8.1/reportingmodule/investigations/options/filtersimple.webp create mode 100644 static/images/threatprevention/8.1/reportingmodule/investigations/options/investigationduplicate.webp create mode 100644 static/images/threatprevention/8.1/reportingmodule/investigations/options/investigationoptions.webp create mode 100644 static/images/threatprevention/8.1/reportingmodule/investigations/options/operatormenu.webp create mode 100644 static/images/threatprevention/8.1/reportingmodule/investigations/options/scheduleexport.webp create mode 100644 static/images/threatprevention/8.1/reportingmodule/investigations/options/sendasemail.webp create mode 100644 static/images/threatprevention/8.1/reportingmodule/investigations/options/subscription.webp create mode 100644 static/images/threatprevention/8.1/reportingmodule/investigations/options/timeframe.webp create mode 100644 static/images/threatprevention/8.1/reportingmodule/investigations/predefinedinvestigations.webp create mode 100644 static/images/threatprevention/8.1/reportingmodule/investigations/saveinvestigation.webp create mode 100644 static/images/threatprevention/8.1/reportingmodule/investigations/search.webp create mode 100644 static/images/threatprevention/8.1/reportingmodule/investigations/subscriptionsexports.webp create mode 100644 static/images/threatprevention/8.1/reportingmodule/investigations/subscriptionsexportsactions.webp create mode 100644 static/images/threatprevention/8.1/reportingmodule/investigations/tableoptions.webp create mode 100644 static/images/threatprevention/8.1/reportingmodule/investigations/topresources.webp create mode 100644 static/images/threatprevention/8.1/reportingmodule/investigations/userdetails.webp create mode 100644 static/images/threatprevention/8.1/reportingmodule/threats.webp create mode 100644 static/images/threatprevention/8.1/siemdashboard/qradar/dashboard/about.webp create mode 100644 static/images/threatprevention/8.1/siemdashboard/qradar/dashboard/adchanges.webp create mode 100644 static/images/threatprevention/8.1/siemdashboard/qradar/dashboard/administratorauditing.webp create mode 100644 static/images/threatprevention/8.1/siemdashboard/qradar/dashboard/authenticationattacks.webp create mode 100644 static/images/threatprevention/8.1/siemdashboard/qradar/dashboard/gpomonitoring.webp create mode 100644 static/images/threatprevention/8.1/siemdashboard/qradar/dashboard/hostinvestigation.webp create mode 100644 static/images/threatprevention/8.1/siemdashboard/qradar/dashboard/ldap.webp create mode 100644 static/images/threatprevention/8.1/siemdashboard/qradar/dashboard/overview.webp create mode 100644 static/images/threatprevention/8.1/siemdashboard/qradar/dashboard/policyreporting.webp create mode 100644 static/images/threatprevention/8.1/siemdashboard/qradar/dashboard/userinvestigation.webp create mode 100644 static/images/threatprevention/8.1/siemdashboard/qradar/offenses.webp create mode 100644 static/images/threatprevention/8.1/siemdashboard/qradar/settings.webp create mode 100644 static/images/threatprevention/8.1/siemdashboard/qradar/topribbon.webp create mode 100644 static/images/threatprevention/8.1/siemdashboard/splunk/activedirectory/dashboard/adchanges.webp create mode 100644 static/images/threatprevention/8.1/siemdashboard/splunk/activedirectory/dashboard/administratorauditing.webp create mode 100644 static/images/threatprevention/8.1/siemdashboard/splunk/activedirectory/dashboard/authenticationattacks.webp create mode 100644 static/images/threatprevention/8.1/siemdashboard/splunk/activedirectory/dashboard/gpomonitoring.webp create mode 100644 static/images/threatprevention/8.1/siemdashboard/splunk/activedirectory/dashboard/ldap.webp create mode 100644 static/images/threatprevention/8.1/siemdashboard/splunk/activedirectory/dashboard/policyreporting.webp create mode 100644 static/images/threatprevention/8.1/siemdashboard/splunk/activedirectory/dashboard/userbehavioranalytics.webp create mode 100644 static/images/threatprevention/8.1/siemdashboard/splunk/activedirectory/topribbon.webp create mode 100644 static/images/threatprevention/8.1/siemdashboard/splunk/threathunting/dashboard/perpetratorhunting.webp create mode 100644 static/images/threatprevention/8.1/siemdashboard/splunk/threathunting/dashboard/privilegecreep.webp create mode 100644 static/images/threatprevention/8.1/siemdashboard/splunk/threathunting/dashboard/sensitivedatahunting.webp create mode 100644 static/images/threatprevention/8.1/siemdashboard/splunk/threathunting/ribbon.webp create mode 100644 static/images/threatprevention/8.1/troubleshooting/delegates.webp create mode 100644 static/images/threatprevention/8.1/troubleshooting/inboxproperties.webp create mode 100644 static/images/threatprevention/8.1/troubleshooting/lsassprocessterminated.webp create mode 100644 static/images/threatprevention/8.1/troubleshooting/permissionnotsaved.webp create mode 100644 static/images/threatprevention/8.1/troubleshooting/serverproperties.webp create mode 100644 static/images/threatprevention/8.1/troubleshooting/sqlservermanagementstudio.webp create mode 100644 static/images/threatprevention/8.1/troubleshooting/warning.webp diff --git a/docs/threatprevention/8.1/admin/_category_.json b/docs/threatprevention/8.1/admin/_category_.json new file mode 100644 index 0000000000..51435b6e32 --- /dev/null +++ b/docs/threatprevention/8.1/admin/_category_.json @@ -0,0 +1,10 @@ +{ + "label": "Administration", + "position": 40, + "collapsed": true, + "collapsible": true, + "link": { + "type": "doc", + "id": "overview" + } +} \ No newline at end of file diff --git a/docs/threatprevention/8.1/admin/agents/_category_.json b/docs/threatprevention/8.1/admin/agents/_category_.json new file mode 100644 index 0000000000..bbf550f6ac --- /dev/null +++ b/docs/threatprevention/8.1/admin/agents/_category_.json @@ -0,0 +1,10 @@ +{ + "label": "Agents Interface", + "position": 40, + "collapsed": true, + "collapsible": true, + "link": { + "type": "doc", + "id": "overview" + } +} \ No newline at end of file diff --git a/docs/threatprevention/8.1/admin/agents/agent-management/_category_.json b/docs/threatprevention/8.1/admin/agents/agent-management/_category_.json new file mode 100644 index 0000000000..d48b1d56c3 --- /dev/null +++ b/docs/threatprevention/8.1/admin/agents/agent-management/_category_.json @@ -0,0 +1,6 @@ +{ + "label": "Agent Management", + "position": 40, + "collapsed": true, + "collapsible": true +} \ No newline at end of file diff --git a/docs/threatprevention/8.1/admin/agents/agent-management/clearqueue.md b/docs/threatprevention/8.1/admin/agents/agent-management/clearqueue.md new file mode 100644 index 0000000000..1f291fc20d --- /dev/null +++ b/docs/threatprevention/8.1/admin/agents/agent-management/clearqueue.md @@ -0,0 +1,62 @@ +--- +title: "Clear SQLite Agent Queue" +description: "Clear SQLite Agent Queue" +sidebar_position: 80 +--- + +# Clear SQLite Agent Queue + +When the Agent is unable to communicate with the Enterprise Manager, Agent events queue up in the +Agents local SQLite database until the Enterprise Manager is available to accept events. The Clear +SQLite Agent Queue option dumps the queue and all pending events are lost. + +Follow the steps to clear the SQLite Agent queue for an Agent: + +:::warning +These events are permanently deleted and are not processed by the Enterprise Manager on +reconnection. This option is for diagnostic and troubleshooting purposes only. +::: + + +**Step 1 –** Click Agents in the left pane to launch the Agents interface. + +**Step 2 –** Right-click a server/Agent and select **Clear SQLite Agent Queue** on the menu. + +![Enter Credentials window](/images/threatprevention/8.1/install/upgrade/entercredentials.webp) + +**Step 3 –** On the Enter Credentials window, enter a username and password with sufficient rights +to connect to the target machine and query information about shares. A local Administrator account +on the target machine should have access to the system shares. Click **OK** after entering the +credentials. + +:::note +The wizard does not block access to the Administration Console and can be minimized while +actions are in progress. If this wizard is hidden by clicking outside of the dialog box, a flashing +blue link displays on the upper right corner of the interface with the action name displayed. Click +this link to bring back the focus to the wizard. +::: + + +**Step 4 –** On the Access Verification window, the system performs a prerequisites or verification +check that can fail or succeed. + +- Failed – Read the failure messages and close the window. Ensure any error messages are taken care + of prior to the next attempt. +- Success – Click **Next** to begin clearing the SQLite Agent Queue + +:::note +Closing the Administration Console while this action is in process causes problems with +data collection. +::: + + +**Step 5 –** The Clear Agent Queue window displays the task in progress and then its status as +either: + +- Failed – Read the failure messages and close the window. Ensure any error messages are taken care + of prior to the next attempt. +- Completed – Indicates that the task is completed + +**Step 6 –** When the task is successfully completed, click **Finish** to close the window. + +The SQLite Agent queue is automatically cleared. diff --git a/docs/threatprevention/8.1/admin/agents/agent-management/harden.md b/docs/threatprevention/8.1/admin/agents/agent-management/harden.md new file mode 100644 index 0000000000..d096f3f988 --- /dev/null +++ b/docs/threatprevention/8.1/admin/agents/agent-management/harden.md @@ -0,0 +1,47 @@ +--- +title: "Harden Agent" +description: "Harden Agent" +sidebar_position: 40 +--- + +# Harden Agent + +You van harden an Agent to protect it from being altered, stopped, or started from within the local +Service Control Manager. + +Follow the steps to harden the Agent on a server. + +**Step 1 –** Click Agents in the left pane to launch the Agents interface. + +**Step 2 –** Right-click a server/Agent and select **Harden Agent** on the menu. + +**Step 3 –** On the Access Verification window, the system performs a prerequisites or verification +check that can fail or succeed. + +- Failed – Read the failure messages and close the window. Ensure any error messages are taken care + of prior to the next attempt. +- Success – Click **Next** to begin hardening the Agent. + +:::note +The wizard does not block access to the Administration Console and can be minimized while +actions are in progress. If this wizard is hidden by clicking outside of the dialog box, a flashing +blue link displays on the upper right corner of the interface with the action name displayed. Click +this link to bring back the focus to the wizard. +::: + + +:::note +Closing the Administration Console while this action is in process causes problems with +data collection. +::: + + +**Step 4 –** The Harden Agent window displays the task in progress and then its status as either: + +- Failed – Read the failure messages and close the window. Ensure any error messages are taken care + of prior to the next attempt. +- Completed – Indicates that the task is completed + +**Step 5 –** When the task is successfully completed, click **Finish** to close the window. + +The Agent's status is displayed as _Hardened_. diff --git a/docs/threatprevention/8.1/admin/agents/agent-management/removeserver.md b/docs/threatprevention/8.1/admin/agents/agent-management/removeserver.md new file mode 100644 index 0000000000..574ff5b040 --- /dev/null +++ b/docs/threatprevention/8.1/admin/agents/agent-management/removeserver.md @@ -0,0 +1,25 @@ +--- +title: "Remove Server from List" +description: "Remove Server from List" +sidebar_position: 70 +--- + +# Remove Server from List + +The Agents Interface displays a list of servers where the Agent has been deployed. You may want to +remove a server from this list for any reason, such as when the Agent is no longer required on the +server. + +:::note +If the server has a deployed Agent, it will be added back to the list the next time the +Agent sends information to the Enterprise Manager. +::: + + +Follow the steps to remove a server from the list on the Agents Interface. + +**Step 1 –** Click Agents in the left pane to launch the Agents interface. + +**Step 2 –** Right-click a server and select **Remove Server from List** on the menu. + +The server is removed from the list. diff --git a/docs/threatprevention/8.1/admin/agents/agent-management/soften.md b/docs/threatprevention/8.1/admin/agents/agent-management/soften.md new file mode 100644 index 0000000000..2b8727e8b5 --- /dev/null +++ b/docs/threatprevention/8.1/admin/agents/agent-management/soften.md @@ -0,0 +1,47 @@ +--- +title: "Soften Agent" +description: "Soften Agent" +sidebar_position: 50 +--- + +# Soften Agent + +You can soften a previously hardened Agent. Softening unlocks the Agent so it can be controlled from +within the local Service Control Manager. + +Follow the steps to soften the Agent on a server. + +**Step 1 –** Click Agents in the left pane to launch the Agents interface. + +**Step 2 –** Right-click a hardened Agent and select **Soften Agent** on the menu. + +**Step 3 –** On the Access Verification window, the system performs a prerequisites or verification +check that can fail or succeed. + +- Failed – Read the failure messages and close the window. Ensure any error messages are taken care + of prior to the next attempt. +- Success – Click **Next** to begin softening the Agent. + +:::note +The wizard does not block access to the Administration Console and can be minimized while +actions are in progress. If this wizard is hidden by clicking outside of the dialog box, a flashing +blue link displays on the upper right corner of the interface with the action name displayed. Click +this link to bring back the focus to the wizard. +::: + + +:::note +Closing the Administration Console while this action is in process causes problems with +data collection. +::: + + +**Step 4 –** The Soften Agent window displays the task in progress and then its status as either: + +- Failed – Read the failure messages and close the window. Ensure any error messages are taken care + of prior to the next attempt. +- Completed – Indicates that the task is completed + +**Step 5 –** When the task is successfully completed, click **Finish** to close the window. + +The Agent has been softened. diff --git a/docs/threatprevention/8.1/admin/agents/agent-management/start.md b/docs/threatprevention/8.1/admin/agents/agent-management/start.md new file mode 100644 index 0000000000..3c9aaf545d --- /dev/null +++ b/docs/threatprevention/8.1/admin/agents/agent-management/start.md @@ -0,0 +1,42 @@ +--- +title: "Start Agent" +description: "Start Agent" +sidebar_position: 10 +--- + +# Start Agent + +If the Agent has stopped on a server, it no longer monitors and captures events. You must restart it +on the server to enable it to monitor and capture the desired events. + +Follow the steps to start a stopped Agent on a server. + +**Step 1 –** Click Agents in the left pane to launch the Agents interface. + +**Step 2 –** Right-click a server/Agent and select **Start Agent** on the menu. + +![Enter Credentials window](/images/threatprevention/8.1/install/upgrade/entercredentials.webp) + +**Step 3 –** On the Enter Credentials window, enter a username and password with sufficient rights +to connect to the target machine and query information about shares. A local Administrator account +on the target machine should have access to the system shares. Click **OK** after entering the +credentials. + +:::note +The wizard does not block access to the Administration Console and can be minimized while +actions are in progress. If this wizard is hidden by clicking outside of the dialog box, a flashing +blue link displays on the upper right corner of the interface with the action name displayed. Click +this link to bring back the focus to the wizard. +::: + + +**Step 4 –** On the Start Agent window, the Agent will be started. One of two status messages +display: + +- Failed – Read the failure messages and close the window. Ensure any error messages are taken care + of prior to the next attempt. +- Completed – Indicates that the task is completed + +**Step 5 –** When the task is successfully completed, click **Finish** to close the window. + +The Agent has been started on the server. diff --git a/docs/threatprevention/8.1/admin/agents/agent-management/startpendingmodules.md b/docs/threatprevention/8.1/admin/agents/agent-management/startpendingmodules.md new file mode 100644 index 0000000000..9672c6827a --- /dev/null +++ b/docs/threatprevention/8.1/admin/agents/agent-management/startpendingmodules.md @@ -0,0 +1,33 @@ +--- +title: "Start Pending Modules" +description: "Start Pending Modules" +sidebar_position: 30 +--- + +# Start Pending Modules + +If the Agent was deployed using the Safe Mode option, then it could enter a _Start Pending Modules_ +state, in which the AD Events monitoring module is not loaded on the machine where the Agent is +deployed. This happens due to a change in the DLL versions. To exit this state, the Threat +Prevention administrator must start the Active Directory module. See the +[Agent Safe Mode](/docs/threatprevention/8.1/admin/agents/safemode.md) topic for additional information. + +:::info +If multiple DCs are in the Start Pending Modules state, this means one of the +monitored system DLLs was changed from when the Agent was last run. This could impact the operation +of the Agent. It is recommended to enable the pending modules on one DC initially and verify that +Threat Prevention is collecting events as expected from this specific DC and that the DC appears to +be stable before starting the pending modules on additional DCs. +::: + + +Follow the steps to start pending modules on a server. + +**Step 1 –** Click Agents in the left pane to launch the Agents interface. + +**Step 2 –** Right-click a server/Agent and select **Start Pending Modules** on the menu. Note that +the Agent will have _Active (Modules Pending)_ as status when there are pending modules. + +The Starting window is displayed. + +**Step 3 –** Once the pending modules are started, the status is displayed as _Active_. diff --git a/docs/threatprevention/8.1/admin/agents/agent-management/stop.md b/docs/threatprevention/8.1/admin/agents/agent-management/stop.md new file mode 100644 index 0000000000..b9d915cb8a --- /dev/null +++ b/docs/threatprevention/8.1/admin/agents/agent-management/stop.md @@ -0,0 +1,41 @@ +--- +title: "Stop Agent" +description: "Stop Agent" +sidebar_position: 20 +--- + +# Stop Agent + +You may want to stop the Agent on a server for any reason, such as troubleshooting. + +Follow the steps to stop the Agent on a server. + +**Step 1 –** Click **Agents** in the left pane to launch the Agents interface. + +![Enter Credentials window](/images/threatprevention/8.1/install/upgrade/entercredentials.webp) + +**Step 2 –** Right-click a server/Agent and select **Stop Agent** on the menu. + +**Step 3 –** On the Enter Credentials window, enter a username and password with sufficient rights +to connect to the target machine and query information about shares. A local Administrator account +on the target machine should have access to the system shares. Click **OK** after entering the +credentials. + +:::note +The wizard does not block access to the Administration Console and can be minimized while +actions are in progress. If this wizard is hidden by clicking outside of the dialog box, a flashing +blue link displays on the upper right corner of the interface with the action name displayed. Click +this link to bring back the focus to the wizard. +::: + + +**Step 4 –** On the Stop Agent window, the Agent will be stopped. One of two status messages +display: + +- Failed – Read the failure messages and close the window. Ensure any error messages are taken care + of prior to the next attempt. +- Completed – Indicates that the task is completed + +**Step 5 –** When the task is successfully completed, click **Finish** to close the window. + +The Agent's status is displayed as _Stopped_. diff --git a/docs/threatprevention/8.1/admin/agents/agent-management/upgradeadmonitor.md b/docs/threatprevention/8.1/admin/agents/agent-management/upgradeadmonitor.md new file mode 100644 index 0000000000..b6ff8c09e3 --- /dev/null +++ b/docs/threatprevention/8.1/admin/agents/agent-management/upgradeadmonitor.md @@ -0,0 +1,45 @@ +--- +title: "Upgrade ADMonitor" +description: "Upgrade ADMonitor" +sidebar_position: 60 +--- + +# Upgrade ADMonitor + +You can update the instrumentation DLL, SI.ActiveDirectoryMonitor.dll (commonly known as ADMonitor +DLL), in LSASS without having to upgrade the entire Agent. To facilitate this, the +[Agents Interface](/docs/threatprevention/8.1/admin/agents/overview.md) displays the currently installed versions of the Agent and the +ADMonitor DLL. + +:::note +The Agent and the ADMonitor DLL should have the same major/minor version, such as 8.0.x.x, +where x.x for the DLL can be equal or higher than that of the Agent. Example: Agent 8.0.0.123 and +DLL 8.0.0.777 +::: + + +In previous Threat Prevention versions, you had to uninstall the Agent and then reinstall it just to +update the ADMonitor DLL. With Threat Prevention 7.5, the _Upgrade ADMonitor_ feature enables you to +simply replace the DLL without having to uninstall and reinstall the Agent. + +Follow the steps to update ADMonitor. + +**Step 1 –** Click **Agents** in the left pane to launch the Agents interface. + +**Step 2 –** Right-click a server/Agent and select **Upgrade ADMonitor** on the menu. + +**Step 3 –** On the Access Verification window, the system runs a check to verify if the Agent is +accessible. If yes, Success is displayed in the Status column. Click **Next** to proceed. + +**Step 4 –** The Upgrade AD Monitor window displays the ADMonitor upgrade progress. Progress +statuses are: + +- Starting – Indicates that the ADMonitor update operation is about to start +- Started – The ADMonitor update operation has successfully started and it is in progress. You may + close the window as the process will complete on its own. +- Failed – Read the failure messages and close the window. Ensure any error messages are taken care + of prior to the next attempt. + +**Step 5 –** When the upgrade completes, click **Close**. + +ADMonitor has been updated. diff --git a/docs/threatprevention/8.1/admin/agents/agents-windows/_category_.json b/docs/threatprevention/8.1/admin/agents/agents-windows/_category_.json new file mode 100644 index 0000000000..4f59c74977 --- /dev/null +++ b/docs/threatprevention/8.1/admin/agents/agents-windows/_category_.json @@ -0,0 +1,6 @@ +{ + "label": "Agents Windows", + "position": 30, + "collapsed": true, + "collapsible": true +} \ No newline at end of file diff --git a/docs/threatprevention/8.1/admin/agents/agents-windows/agentinstallerupdate.md b/docs/threatprevention/8.1/admin/agents/agents-windows/agentinstallerupdate.md new file mode 100644 index 0000000000..99e9afafc5 --- /dev/null +++ b/docs/threatprevention/8.1/admin/agents/agents-windows/agentinstallerupdate.md @@ -0,0 +1,46 @@ +--- +title: "Agent Installer Update Window" +description: "Agent Installer Update Window" +sidebar_position: 10 +--- + +# Agent Installer Update Window + +Netwrix periodically releases updated Agent installation packages. Typically these updates are +associated with Microsoft KBs (hot-fixes) which alter the LSASS components interfering with the +Agent instrumentation. See the [Agent Information](/docs/threatprevention/8.1/install/agent/overview.md) topic for +additional information. + +To download an installation package, the Threat Prevention server must be connected to the internet. +It may be necessary to allow the following URL in the browser security settings: + +- For Threat Prevention v8.0: + [https://www.netwrix.com/go/siagent800zip](https://www.netwrix.com/go/siagent800zip) + +Follow the steps to download the updated Agent installer. + +**Step 1 –** Click **Agents** in the left pane to launch the Agents interface. Then click **Update +Agent Installer** to launch the Agent Installer Update window. + +![Agent Installer Update window](/images/threatprevention/8.1/admin/agents/window/checkfornewversion.webp) + +**Step 2 –** Click **Check for Newer Version of the Netwrix Threat Prevention Agent**. Threat +Prevention downloads the Agent installer from a static URL and then compares the Agent installer +currently in use to the installer downloaded. + +![Agent Installer Update window showing that Agent Installer is up-to-date](/images/threatprevention/8.1/admin/agents/window/uptodate.webp) + +- If the versions are the same, the message specifies **Agent Installer is up-to-date…** and + displays the Agent version number. Click **Close** to close the window. + +![Agent Installer Update window showing that Agent version is outdated](/images/threatprevention/8.1/admin/agents/window/agentversionmismatch.webp) + +- If the downloaded version is newer, the message displays both version numbers and provides an + option to apply the update. Click **Apply Update**. + +:::note +When the Agent installer is replaced with a newer version, all Agents’ versions in the +Agents interface are highlighted to indicate they are not the current version. Agents should then be +updated to the new version using the Upgrade Agent option on the right-click menu. + +::: diff --git a/docs/threatprevention/8.1/admin/agents/agents-windows/configureautodeploy.md b/docs/threatprevention/8.1/admin/agents/agents-windows/configureautodeploy.md new file mode 100644 index 0000000000..c23686b14e --- /dev/null +++ b/docs/threatprevention/8.1/admin/agents/agents-windows/configureautodeploy.md @@ -0,0 +1,40 @@ +--- +title: "Configure Auto Deploy Window" +description: "Configure Auto Deploy Window" +sidebar_position: 20 +--- + +# Configure Auto Deploy Window + +You can automatically deploy Agents to discovered domain controllers in a domain, provided that the +Agent has already been deployed on at least one domain controller in the domain. + +Follow the steps to auto deploy the Agent. + +**Step 1 –** Click **Agents** in the left pane to launch the Agents interface. Then click +**Configure Auto Deploy** to launch the Configure Auto Deploy window. + +![Configure Auto Deploy window](/images/threatprevention/8.1/admin/agents/window/autodeploy.webp) + +**Step 2 –** Select the **Enable Auto Deploy** checkbox to enable the following configuration +options: + +- Credentials – Provide the credentials to use for deploying the Agent on all discovered domain + controllers + - Login – Must be in Domain\User format + - Password +- Agent Deploy Destination Options – Configure the following settings: + - Installation Location – Select the radio button to indicate the installation directory on the + target domain controllers + - Default – Uses the default installation directory + - Textbox – Enter the desired installation location, e.g. d:\myagent + - Safe Mode – If selected, the Agent checks LSASS versions on start up. Any changes in LSASS + since the previous start prevents the Windows AD Events monitoring module from loading. See + the [Agent Safe Mode](/docs/threatprevention/8.1/admin/agents/safemode.md) topic for additional information. + - EM IP Address/Name – Displays the IP address of the machine where Enterprise Manager is + installed + - Port – Displays the port the Enterprise Manager uses to communicate with the Agent + +**Step 3 –** Click **Apply** to enable the auto deploy feature. When domain controllers are +discovered where the Agent is not already installed, Threat Prevention automatically deploys the +Agent with all applicable modules to those domain controllers. diff --git a/docs/threatprevention/8.1/admin/agents/agents-windows/enrollmentsecretconfiguration.md b/docs/threatprevention/8.1/admin/agents/agents-windows/enrollmentsecretconfiguration.md new file mode 100644 index 0000000000..62e2261fff --- /dev/null +++ b/docs/threatprevention/8.1/admin/agents/agents-windows/enrollmentsecretconfiguration.md @@ -0,0 +1,51 @@ +--- +title: "Enrollment Secret Configuration Window" +description: "Enrollment Secret Configuration Window" +sidebar_position: 30 +--- + +# Enrollment Secret Configuration Window + +The Enrollment Secret is a limited-life (1 hour) password generated by the Enterprise Manager. The +Agent Installer uses it to ensure that the Agent is connected to a legitimate Enterprise Manager. It +enables the automatic exchange of certificates between the Enterprise Manager and theAgent. How the +enrollment secret is applied depends on the method used to install the Agent. + +- If using the Administration Console to deploy the Agent, the console will automatically generate + and use a new enrollment secret as part of automated Agent installation. +- If installing the Agent manually, the enrollment secret must be entered in the Certificates window + of the Agent Setup wizard during installation. See the + [Manual Agent Deployment](/docs/threatprevention/8.1/install/agent/manual.md) topic for additional information. + +To generate the enrollment secret, complete the following steps: + +**Step 1 –** Click **Agents** in the left pane to launch the Agents interface. Then click **Agent +Enrollment Secret** to launch the Enrollment Secret Configuration window. + +![Enrollment Secret Configuration window](/images/threatprevention/8.1/admin/agents/window/enrollmentsecret.webp) + +Use the Enrollment Secret Configuration window to generate the enrollment secret required to +manually deploy the Agent. It has the following fields: + +- Enrollment Secret – A limited-life (1 hour) password generated by the Enterprise Manager. The + Agent Installer uses it to ensure that the Agent is connected to a legitimate Enterprise Manager. +- Expires in – The expiration date timestamp for the enrollment secret +- EM cert – The Enterprise Manager certificate generated by the certificate authority for use by the + Enterprise Manager to establish trust between the Enterprise Manager and other modules including + the Agent + + - Note the value of the Enterprise Manager certificate (EM cert) and verify that it is the same + value displayed in the Agent installer to ensure that the Agent is connecting to a legitimate + Enterprise Manager. + +**Step 2 –** Click **Generate** to generate an enrollment secret, which is valid for 1 hour. + +- When deploying the Agent from the Administration Console, a new enrollment secret is automatically + created, which invalidates any previous secret that has not expired. . +- Click **Copy** to copy the enrollment secret and enter it in the Certificates window of the Agent + Setup wizard during manual Agent installation. + +:::note +Restarting the Enterprise Manager cancels the current enrollment secret. + +::: diff --git a/docs/threatprevention/8.1/admin/agents/agents-windows/loglevelconfiguration.md b/docs/threatprevention/8.1/admin/agents/agents-windows/loglevelconfiguration.md new file mode 100644 index 0000000000..07d6103440 --- /dev/null +++ b/docs/threatprevention/8.1/admin/agents/agents-windows/loglevelconfiguration.md @@ -0,0 +1,109 @@ +--- +title: "Log Level Configuration Window" +description: "Log Level Configuration Window" +sidebar_position: 40 +--- + +# Log Level Configuration Window + +The Log Level Configuration window displays the current log levels for the Agents, Enterprise +Manager, and Administration Console. It also enables you to set new log levels. + +:::note +Since Threat Prevention supports multiple instances of the Administration Console, each +instance has its own settings for log levels. Changing the settings only affect the respective +console instance. The Enterprise Manager and Agent log settings are global - the most recent changes +made from any console instance apply. +::: + + +Follow the steps to set log levels. + +**Step 1 –** Click **Agents** in the left pane to launch the Agents interface. Then click **Update +Logging Levels** on the top bar to launch the Log Level Configuration window. + +![Log Level Configuration Window](/images/threatprevention/8.1/admin/agents/window/loglevelconfiguration.webp) + +**Step 2 –** To update the logging level for an Agent: + +- The Active Agent List data grid lists the active Agents with the following information: + + - Platform – Operating system platform for the machine where the Agent is deployed, for example, + Windows + - Domain – Targeted Active Directory domain + - Machine Name – Server where the Agent is deployed + - Agent Address – IP address of the server where the Agent is deployed + - Version – Agent build version + - Log Level – The current log level set for the Agent + +- Select an Agent in the data grid and choose a new log level from the New Agent Log Level dropdown + menu. Then click Update Log Levels to assign the log level to the Agent. Available file log levels + are: + + - Debug – Records everything that happens, most verbose level of logging + - Info – Records information about individual APIs called, in addition to warnings and errors + - Warn – Records all warnings that occur, in addition to errors + - Error – Records all errors that occur + - Fatal – Records only when catastrophic system failures/crashes occur + + No matter what log level is selected, the logs have a maximum cap size of 55 MB. When a log file + reaches 50 MB, it is closed and a new file is started. No more than ten closed files (50 MB) are + kept. When the eleventh file reaches 50 MB, the oldest closed file is overwritten. + +**Step 3 –** To update the logging level for Enterprise Manager and the Administration Console: + +- Current Level – The current log level set for the Enterprise Manager / Administration Console +- New Level – Use the dropdown menu to select a new log level.Then click Update Log Levels to assign + the new log level to the Enterprise Manager / Administration Console. +- Build – The build of the Enterprise Manager / Administration Console. The builds may differ in + rare scenarios. +- Time Stamp – The date and time when the Enterprise Manager / Administration Console build was last + updated + +**Step 4 –** Click **Close** to close the window. + +## Access Agent Log Files + +Follow the steps to access the Agent log files. + +![Get Agent Log icon](/images/threatprevention/8.1/admin/agents/window/getagentlog.webp) + +**Step 1 –** Click **Agents** in the left pane to launch the Agents interface. Select a server/Agent +and click **Get Agent Log** . + +![Save As window for Agent logs](/images/threatprevention/8.1/admin/agents/window/saveaswindow.webp) + +**Step 2 –** The Save As window opens with the selected Agent’s log already selected from its +original location. Select the new location and click **Save**. + +You can now view a copy of the log file without navigating to its location on the machine where the +Agent is deployed. + +## Access the Enterprise Manager & Administration Console Log Files + +The Enterprise Manager log files are stored on the Threat Prevention server while the Administration +Console log files are stored on the machine where the respective console is installed. + +Log files are stored in the following locations: + +**Enterprise Manager Log Files** + +![Enterprise Manager Log File Location](/images/threatprevention/8.1/admin/agents/window/emlogs.webp) + +The default location is: + +**…\Netwrix\Netwrix Threat Prevention\SIEnterpriseManager\logs\** + +Administration Console Log Files + +![Administration Console Log File Location](/images/threatprevention/8.1/admin/agents/window/consolelogs.webp) + +The default location is: + +**…\Netwrix\Netwrix Threat Prevention\SIWinConsole\logs\** + +:::note +Log files for a remote instance of the Administration Console are available at the same +location on the respective machine. + +::: diff --git a/docs/threatprevention/8.1/admin/agents/deploy/_category_.json b/docs/threatprevention/8.1/admin/agents/deploy/_category_.json new file mode 100644 index 0000000000..3b79969e0b --- /dev/null +++ b/docs/threatprevention/8.1/admin/agents/deploy/_category_.json @@ -0,0 +1,10 @@ +{ + "label": "Deploy Agents", + "position": 20, + "collapsed": true, + "collapsible": true, + "link": { + "type": "doc", + "id": "overview" + } +} \ No newline at end of file diff --git a/docs/threatprevention/8.1/admin/agents/deploy/installing.md b/docs/threatprevention/8.1/admin/agents/deploy/installing.md new file mode 100644 index 0000000000..ae11d0eb7f --- /dev/null +++ b/docs/threatprevention/8.1/admin/agents/deploy/installing.md @@ -0,0 +1,20 @@ +--- +title: "Installing Window" +description: "Installing Window" +sidebar_position: 40 +--- + +# Installing Window + +The Deploy Agents wizard's Installing window is the last in a sequence of four windows to deploy the +Agent on a computer. This window performs the desired action, tracks the deployment process, and +displays a successful or failed status. + +![Deploy Agents wizard – Installing page](/images/threatprevention/8.1/admin/agents/deploy/installing.webp) + +It displays the working and completed status of the action. Depending on whether the Agent is +deployed successfully, the Message column displays a failed message with additional text or a +successful message if the Agent is deployed correctly. + +To stop the deployment process on any machines that have not yet started deployment, click Cancel. +The Close button changes to a Finish button once all Agents are deployed. diff --git a/docs/threatprevention/8.1/admin/agents/deploy/overview.md b/docs/threatprevention/8.1/admin/agents/deploy/overview.md new file mode 100644 index 0000000000..173b495f67 --- /dev/null +++ b/docs/threatprevention/8.1/admin/agents/deploy/overview.md @@ -0,0 +1,134 @@ +--- +title: "Deploy Agents" +description: "Deploy Agents" +sidebar_position: 20 +--- + +# Deploy Agents + +The Threat Prevention Agent can be deployed through any of the following methods: + +- Deploy the Agent to servers through the Administration Console – You can deploy the Agent to one + or multiple servers through the Administration Console + + :::info + This is the recommended method for deploying the Agent. + ::: + + +- Manually through the Windows Agent Setup Wizard – Run the Agent executable to launch this wizard + +See the [Manual Agent Deployment](/docs/threatprevention/8.1/install/agent/manual.md) topic for additional +information. + +## Deploy Agents Wizard + +Use the Deploy Agents wizard to deploy Agents from the Administration Console. Computers +targeted for Agent deployment must meet the minimum .NET Framework version required by the Agent or +the deployment fails. Remember to check server requirements before deploying the Agent, including +compatibility with other security products. See the +[Agent Server Requirements](/docs/threatprevention/8.1/requirements/agent/agent.md) topic for additional information. + +:::note +The wizard doesn't block access to the Administration Console and can be minimized while +actions are in progress. If this wizard is hidden by clicking outside of the dialog box, a flashing +blue link displays on the upper right corner of the interface with the action name displayed. Click +the flashing blue link to bring back the focus to the wizard. +::: + + +The Deploy Agents wizard consists of four windows: Select Computers, Set Options, Prerequisites +Check, and Installing. + +To deploy the Agent from the Administration Console to a new or existing machine +using the Deploy Agents wizard, complete the following steps: + +:::warning +Closing the Administration Console while this action is in process causes problems with +data collection. +::: + + +**Step 1 –** Click Agents in the left pane to launch the Agents interface. + +**Step 2 –** On the Agents interface, click the **Deploy Agent** (**+**) button on the top right +corner. To re-install a previously uninstalled Agent, select the **Install Agent** right-click menu +option for that machine in the grid. The Select Computers window opens. + +![Deploy Agents wizard – Select Computers page](/images/threatprevention/8.1/admin/agents/deploy/selectcomputers.webp) + +**Step 3 –** On the Select Computers window, add the host or IP addresses of the target machines to +the Deploy Agents to These Computers box. Use any of the three methods, as represented by the three +tabs on the window. See the [Select Computers Window](/docs/threatprevention/8.1/admin/agents/deploy/selectcomputers.md) topic for additional +information. Click **Next**. + +If you open this window through the [Right-Click Menu](/docs/threatprevention/8.1/admin/agents/overview.md#right-click-menu) action, the +list is auto-populated with the computers selected on the Agents interface. + +![Deploy Agents wizard – Set Options page](/images/threatprevention/8.1/admin/agents/deploy/setoptions.webp) + +**Step 4 –** On the Set Options window, enter the credentials required to deploy the Agent on the +selected machines. Review the Enterprise Manager IP address/name and port for accuracy and select +the modules you want to install for this Agent. You can also set other properties for the Agent. See +the [Set Options Window ](/docs/threatprevention/8.1/admin/agents/deploy/setoptions.md)topic for additional information. + +**Step 5 –** Once configurations are set, click **Next**. + +![Deploy Agents wizard – Prerequisites Check page](/images/threatprevention/8.1/admin/agents/deploy/prerequisitescheck.webp) + +**Step 6 –** On the Prerequisites Check window, the credentials provided on the Set Options window +either succeed or fail during a prerequisites or verification check. It also initiates a +prerequisite check for the Agent. See the [Prerequisites Check Window](/docs/threatprevention/8.1/admin/agents/deploy/prerequisitescheck.md) topic +for additional information. + +![Deploy Agents wizard – Installing page](/images/threatprevention/8.1/admin/agents/deploy/installing.webp) + +**Step 7 –** The Installing window performs the installation and displays whether the action +was successful. See the [Installing Window ](/docs/threatprevention/8.1/admin/agents/deploy/installing.md) topic for additional information. + +**Step 8 –** When the task is successfully completed, click **Finish** to close the window. + +The Agent appears in the table on the Agents interface. + +:::note +If the server where the Agent is deployed has multiple network adapters (multi-homed), +then you must bind the Agent to an adapter that can communicate with the Enterprise +Manager. See the [Bind To](/docs/threatprevention/8.1/troubleshooting/agentcommunication.md#bind-to) topic for +additional information. +::: + + +## Update Agent Settings + +To update the settings for a deployed Agent through the Agents interface, complete the following steps: + +**Step 1 –** Click Agents in the left pane to launch the Agents interface. + +**Step 2 –** On the Agents interface, right-click the Agent and select Update Agent Settings on the +[Right-Click Menu](/docs/threatprevention/8.1/admin/agents/overview.md#right-click-menu). The Select Computers window opens. + +**Step 3 –** On the Select Computers window, the computer where the Agent is deployed is +automatically added to the Update Agent settings on These Computers box. See the +[Select Computers Window](/docs/threatprevention/8.1/admin/agents/deploy/selectcomputers.md) topic for additional information. Click **Next**. + +**Step 4 –** On the Set Options window, ensure the proper credentials, modules, and Enterprise +Manager location are accurate alongside additional options. To make changes to the settings, uncheck +the **Keep Existing Settings** box. Make the necessary updates. See the +[Set Options Window ](/docs/threatprevention/8.1/admin/agents/deploy/setoptions.md) topic for additional information. + +**Step 5 –** On the Prerequisites Check window, the credentials provided on the Set Options window +either succeed or fail during a prerequisites or verification check. See the +[Prerequisites Check Window](/docs/threatprevention/8.1/admin/agents/deploy/prerequisitescheck.md) topic for additional information. Click +**Next**. + +**Step 6 –** On the Updating Settings window, the Agent will be stopped and restarted. One of two +status messages display: + +- Failed – Read the failure message and either click **Back** to provide new credentials or click + **Finish** to close the window and resolve any error messages before the next + attempt +- Completed – Indicates that the Agent has been successfully updated + +**Step 7 –** Click **Finish** to close the window. + +The status of the Agent update will display in the grid on the Agents interface. diff --git a/docs/threatprevention/8.1/admin/agents/deploy/prerequisitescheck.md b/docs/threatprevention/8.1/admin/agents/deploy/prerequisitescheck.md new file mode 100644 index 0000000000..ad032d9e9c --- /dev/null +++ b/docs/threatprevention/8.1/admin/agents/deploy/prerequisitescheck.md @@ -0,0 +1,28 @@ +--- +title: "Prerequisites Check Window" +description: "Prerequisites Check Window" +sidebar_position: 30 +--- + +# Prerequisites Check Window + +The Deploy Agents wizard's Prerequisites Check window is the third in a sequence of four windows to +deploy the Agent on a computer. On this window, Threat Prevention checks if the provided credentials +successfully allow Agent deployment. + +![Deploy Agents wizard – Prerequisites Check page](/images/threatprevention/8.1/admin/agents/deploy/prerequisitescheck.webp) + +After the check is run, the status registers as either Success or Failed. Select a host to view the +full message in the box at the bottom of the window. + +- Failed – Read the failure message and either click **Back** to provide new credentials or click + **Finish** to close the window and ensure any error messages are taken care of prior to next + attempt +- Success – Click **Next** to install the Agent +- If some but not all items fail, you can click **Next** to deploy the Agent on those where access + verification was successful + +In addition to confirming access, Threat Prevention also verifies if the target machine has the +minimum .NET Framework version needed by the Agent already installed; else the deployment fails. + +See the [Installing Window ](/docs/threatprevention/8.1/admin/agents/deploy/installing.md)topic for the next step. diff --git a/docs/threatprevention/8.1/admin/agents/deploy/selectcomputers.md b/docs/threatprevention/8.1/admin/agents/deploy/selectcomputers.md new file mode 100644 index 0000000000..cecdfe3dac --- /dev/null +++ b/docs/threatprevention/8.1/admin/agents/deploy/selectcomputers.md @@ -0,0 +1,60 @@ +--- +title: "Select Computers Window" +description: "Select Computers Window" +sidebar_position: 10 +--- + +# Select Computers Window + +The Deploy Agents wizard's Select Computer window is the first in a sequence of four windows to +deploy the Agent on a computer. It provides three methods for selecting computers where Agent(s) can +be deployed: + +- Add Single Host +- Add from AD +- Add from File + +Any combination of these three methods can be used to select computers. + +## Add Single Host Tab + +The Add Single Host tab is displayed by default when the Select Computer window opens. + +![Deploy Agents wizard – Select Computers page](/images/threatprevention/8.1/admin/agents/deploy/selectcomputers.webp) + +Manually enter and select the host name or IP address of a computer. Use the double-arrow button to +add it to the Deploy Agents to These Computers box. + +## Add From AD Tab + +Click the Add From AD tab. + +![Deploy Agents wizard – Select Computers page: Add from AD tab](/images/threatprevention/8.1/admin/agents/deploy/addfromad.webp) + +Browse the domain's computer objects (Domain Controllers and Computers) to select those where you +want to deploy the Agent. + +- Domain to Browse – Displays the domain where the Enterprise Manager resides. If unpopulated, type + the desired domain in the textbox. Click Connect to connect to the domain. +- List of Domain Controllers/Computers – Populates with computers found in Active Directory +- Add (>) button – Adds the selected computer(s) to the Deploy Agents to These Computers box + +> **NOTE:** Multiple computers can be selected and moved to the Deploy Agents to These Computers +> box. Checking a top-level node automatically selects all child objects. + +## Add From File Tab + +Click the Add From File tab. + +![Deploy Agents wizard – Select Computers page: Add from File tab](/images/threatprevention/8.1/admin/agents/deploy/addfromfile.webp) + +You can import a text file with a list of computer names or IP addresses with carriage returns, or a +CSV file with comma-separated values. + +- Text File to Read – Click Open to browse and select the required file. The box displays the path + to the file. +- List of Hosts/IP Addresses – Populates with computers from the text/CSV file +- Add (>) button – Adds the selected computer(s) to the Deploy Agents to These Computers box + +Once the list in the Deploy Agents to These Computers box is complete, you can continue through the +wizard to deploy the Agent. See the [Set Options Window ](/docs/threatprevention/8.1/admin/agents/deploy/setoptions.md)topic for the next step. diff --git a/docs/threatprevention/8.1/admin/agents/deploy/setoptions.md b/docs/threatprevention/8.1/admin/agents/deploy/setoptions.md new file mode 100644 index 0000000000..e6898db186 --- /dev/null +++ b/docs/threatprevention/8.1/admin/agents/deploy/setoptions.md @@ -0,0 +1,116 @@ +--- +title: "Set Options Window" +description: "Set Options Window" +sidebar_position: 20 +--- + +# Set Options Window + +The Deploy Agents wizard's Set Options window is the second in a sequence of four windows to deploy +the Agent on a computer. + +On the Set Options window, you can manage Agent settings, such as credentials, Enterprise Manager +information, modules, DNS host name resolution, and safe mode. + +![Deploy Agents wizard - Set Options page](/images/threatprevention/8.1/admin/agents/deploy/setoptions.webp) + +The Set Options window provides the following options: + +- Use These Credentials – Credentials to be used to deploy the Agent on the selected computers + - Username – Must be in the DOMAIN\Username format + - Password – Username password +- Enterprise Manager – IP address/name and port where the Enterprise Manager is located +- Modules to Install – Select the check boxes for the modules to be installed on the selected + computers: + - Windows AD Events – Installs the Threat Prevention for Active Directory Solution and Threat + Prevention for LDAP Solution + - Windows File System – Installs the Threat Prevention for File System Solution + - Exchange Server Monitoring – Installs the Threat Prevention for Exchange Solution + - Windows Event Logs – Deprecated functionality for v7.0+ Agents +- Agent Service + + - Safe Mode – The Agent checks LSASS versions on start up. Any changes in LSASS since the + previous start prevents the AD Events monitoring module from loading. See the + [Agent Safe Mode](/docs/threatprevention/8.1/admin/agents/safemode.md) topic for additional information. + - Use local Pwned hash DB – A local copy of the Pwned hash database is sent to the Agent after + installation from the Enterprise Manager. Any updates to the database are sent from the + Enterprise Manager to the Agent(s) as long as the Agent service is enabled. + - Start Agent Service – Starts the Threat Prevention Agent service on host after installation + + :::note + If the Agent Service is not started at the time of deployment, the Agent requires + a manual start or will be started automatically after a server reboot. Until the Agent is + started, no activity is monitored or blocked. + ::: + + +- Create Windows Firewall Rules – Creates firewall rules on the selected computers for Agent + communication +- Install to default location – Installs the Agent on the machine to the default location or a + specified location. + +![Deploy Agents wizard – Set Options page: Agent Install Path box](/images/threatprevention/8.1/admin/agents/deploy/installpath.webp) + +If checked, the Agent is installed to the default location: ...\Netwrix\Netwrix Threat +Prevention\SIWindowsAgent + +If unchecked, specify the desired installation location, e.g. d:\myagent. + +The installation location applies to all computers where the Agent is being deployed in this session +(as specified on the [Select Computers Window](/docs/threatprevention/8.1/admin/agents/deploy/selectcomputers.md) of the Deploy Agents wizard). +Once these settings are configured as desired, the Agent is ready for deployment on the selected +machines. See the [Prerequisites Check Window](/docs/threatprevention/8.1/admin/agents/deploy/prerequisitescheck.md) topic for the next step. + +##### DNS Host Name Resolution + +The Agent is configured to “Enable DNS Host Name Resolution” by default during deployment. Depending +on the event type, the Agent may see some but not all of the following information: + +- NetBIOS name +- Fully Qualified Domain Name +- IP Address + +This information is stored in the SIWindowsAgent.exe.confg file as XML tags/values in the folder the +Agent is installed to. When the Agent Service starts, it reads this file. + +When the Enable DNS Host Name Resolution option is enabled, the Agent looks up the missing data. Raw +events may have one or more of following: SID, domain name, NetBiosName, machine name, and IP +address. When any one of these data points is available, Threat Prevention uses Windows DNS, if +enabled, to collect the missing data points for the raw event from LSASS. This provides more uniform +data, but may have a performance impact on the machine where the Agent is deployed, especially if +name resolution is not handled locally by that machine. + +## Set Options Window for Update Agent Settings + +On the Agents interface, when you open the Set Options window through the Update Agent Settings +option on the [Right-Click Menu](/docs/threatprevention/8.1/admin/agents/overview.md#right-click-menu), the window appears as follows: + +![Update Agent Settings > Set Options page](/images/threatprevention/8.1/admin/agents/deploy/updatesetoptions.webp) + +This window displays the default selections in the Modules to Set and Additional Options areas; they +do not represent the actual current state of the Agent. + +:::note +To view the current state and configured options for an Agent, hover over the Version +String column on the [Agents Interface](/docs/threatprevention/8.1/admin/agents/overview.md) data grid for the tool tip. The AD Agent +column indicates the Agent’s mode. +::: + + +This Set Options window is the same as discussed above, with the exception of the following: + +- Enable DNS Host Name Resolution – See the DNS Host Name Resolution topic for information. Even + when this option is enabled for the Agent, it is displayed as unchecked. You must either check + this setting or check the Keep Existing Settings checkbox to keep it enabled for the Agent. +- Keep Existing Settings – When checked, options in the Modules to Set and Additional Options areas + are grayed out and cannot be changed, indicating that the same current settings are retained for + the Agent. + + This setting has no impact on the Use These Credentials and Enterprise Manager areas. + +:::warning +Make sure you select the desired settings for the Agent on this window, such as the +Enable DNS Host Name Resolution and Safe Mode options, even when they are currently enabled for the +Agent. Leaving them unchecked will disable those settings when the wizard completes. + +::: diff --git a/docs/threatprevention/8.1/admin/agents/overview.md b/docs/threatprevention/8.1/admin/agents/overview.md new file mode 100644 index 0000000000..aebe29b82e --- /dev/null +++ b/docs/threatprevention/8.1/admin/agents/overview.md @@ -0,0 +1,228 @@ +--- +title: "Agents Interface" +description: "Agents Interface" +sidebar_position: 40 +--- + +# Agents Interface + +Use the Agents interface to quickly view, deploy, and manage Agents from a centralized +location to the targeted domain controllers in a domain. The Agent must be deployed on all domain +controllers that you want to receive event data for. Once one or more Agents are deployed to a +domain, it becomes known as a targeted domain. + +The Threat Prevention Agent can be deployed through any of the following methods: + +- Deploy the Agent to servers through the Administration Console – You can deploy the Agent to one + or multiple servers through the Administration Console + + :::info + This is the recommended method for deploying the Agent. + ::: + + +- Manually through the Windows Agent Setup Wizard – Run the Agent executable to launch this wizard + +See the [Deploy Agents](/docs/threatprevention/8.1/admin/agents/deploy/overview.md) and +[Manual Agent Deployment](/docs/threatprevention/8.1/install/agent/manual.md) topics for additional information. + +Click **Agents** in the left pane to open the Agents interface. + +![Agents Interface](/images/threatprevention/8.1/admin/agents/agentsinterface.webp) + +## Agents Data Grid + +The Agents data grid displays information on each domain where an Agent is deployed. + +The upper-right corner of the data grid displays the Agent tally, indicating the number of active +Agents as well as the total number of deployed Agents. The data grid displays the following +information for an Agent: + +- Domain – Targeted Active Directory domain +- Machine – Server where the Agent is deployed. Hover over data in this column to view the following + date/time stamps: + + - Last Agent to Manager Communication – Last change event sent from the Agent to the Enterprise + Manager + - Last Agent Heartbeat – Last time the Enterprise Manager received a heartbeat from the Agent + + ![Warning Symbol for an Agent](/images/threatprevention/8.1/admin/agents/warningsymbol.webp) + + - AD Event Latency – Time difference between when the Agent detected the event and when + the Enterprise Manager received it + + :::note + When the **Send Latency Alerts** option is enabled in the + [Event Filtering Configuration Window](/docs/threatprevention/8.1/admin/configuration/eventfilteringconfiguration.md), a + warning symbol appears to indicate excessive latency. This warning symbol also appears when + the Agent fails to load the instrumentation DLL, SI.ActiveDirectoryMonitor.dll (commonly + known as ADMonitor DLL), into the LSASS process or when it fails to load the instrumentation + DLL to MS Exchange. + ::: + + +- FSMO Roles – The FSMO (Flexible Single Master Operation) roles assigned to the domain + controller where the Agent is deployed. Role names are displayed as abbreviations. For example, + 'SM' is displayed for the Schema Master role. Hover over data in this column to view the full + names. + + :::note + You can use the FSMO roles information in combination with a policy created for the + [FSMO Role Monitoring Event Type](/docs/threatprevention/8.1/admin/policies/configuration/eventtype/fsmorolemonitoring.md) to view events + about which machine acquired a FSMO role and which machine relinquished it. + ::: + + +- Operating System – Operating system for the machine where the Agent is deployed with version + information, including service pack details. For example, Windows Server 2022 Standard.. For + example, Windows Server 2019 Standard + + ![Agents Interface - Agent Statuses](/images/threatprevention/8.1/admin/agents/agentstatuses.webp) + +- Status – the Agent’s current status: + + - Active (green) – The Agent is actively monitoring/blocking events and communicating with the + Enterprise Manager + - Active (Modules Pending) – The Agent is active, but the Windows AD Events module has not been + loaded due to Safe Mode. See the [Agent Safe Mode](/docs/threatprevention/8.1/admin/agents/safemode.md) topic for additional + information. + - Stopped (orange) – The Agent has been stopped and isn't monitoring/blocking events + - Lost Connection (red) – The Agent isn't actively communicating with the Enterprise Manager + - No Agent (gray) – a domain controller has been found within the targeted domain where the + Agent isn't yet deployed + +- Address – IP address of the server where the Agent is deployed. Hover over data in this column to + view the IP address with port +- Agent Version – Installed Agent build version + + - If the Agent’s version is older than the current version available in Threat Prevention, it is + highlighted. This indicates that an upgrade is recommended. + - Hover over data in this column to view a listing of the Agent’s configured settings. This + displays information on modules that are running and those that are pending (for Safe Mode). + +- Available Version – Latest Agent version available in Threat Prevention +- ADMonitor Version – The installed SI.ActiveDirectoryMonitor.dll version + + (commonly known as ADMonitor DLL). The Agent and the ADMonitor DLL should have the same + major/minor version, such as 8.0.x.x, where x.x for the DLL can be equal or higher than that of + the Agent. Example: Agent 8.0.0.123 and DLL 8.0.0.777 + +- UTC Offset – Local server time zone relationship to the Universal Time (UTC) +- Last Events – Number of events reported by the Agent in the last notification to the Enterprise + Manager +- Events In Queue – Count of events the Agent is waiting to send to the Enterprise Manager +- AD Agent – Indicates if the Agent is running in Normal Mode or Safe Mode +- Is Signed – Indicates if the Agent is signed or unsigned +- Free Space – Amount of free space on the drive the Agent is installed on +- Agent Last Stopped – Date timestamp for when the Agent was last stopped +- Build Time Stamp – Date timestamp for when the Agent version was created +- Certificate Thumbprint – The certificate used by the Agent to communicate with Enterprise Manager +- Features – Features available for the Agent and its configured modules +- FQDN – Fully-qualified domain name of the machine where the Agent is deployed +- Last Registration – The date and time when the Agent successfully connected to the Enterprise + Manager (became Active) +- Modules – Event sources loaded and running on the Agent +- Platform – Operating system platform for the machine where the Agent is deployed, for example, + Windows + +This data grid employs features for sorting, filtering, searching, and more. See the +[ Data Grid Functionality](/docs/threatprevention/8.1/admin/navigation/datagrid.md) topic for additional information. + +## Agents Action Buttons + +Use the following icons above the data grid to perform various actions on the Agents +interface + +| Icon | Label | Action | +| ---------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| ![Agents Interface - Export Agent List icon](/images/threatprevention/8.1/admin/agents/exporticon.webp) | Export Agent List… | Save the information to an XML file for export | +| ![Agents Interface - Refresh Agent List icon](/images/threatprevention/8.1/admin/agents/refreshicon.webp) | Refresh Agent List… | Refresh the Agent information | +| ![Agents Interface - Update Logging Levels icon](/images/threatprevention/8.1/admin/agents/updateloggingicon.webp) | Update Logging Levels… | Configure the log levels for the Agents. It opens the [Log Level Configuration Window](/docs/threatprevention/8.1/admin/agents/agents-windows/loglevelconfiguration.md). | +| ![Agents Interface - Get Agent Log icon](/images/threatprevention/8.1/admin/agents/getagentlogicon.webp) | Get Agent Log… | Access Agent log files. See the [Access Agent Log Files](/docs/threatprevention/8.1/admin/agents/agents-windows/loglevelconfiguration.md#access-agent-log-files) topic for additional information. | +| ![Agents Interface - Update Agent Installer icon](/images/threatprevention/8.1/admin/agents/updateinstallericon.webp) | Update Agent Installer | Check with Netwrix for a newer version of the Agent Installer according to the version in use. It opens the [Agent Installer Update Window](/docs/threatprevention/8.1/admin/agents/agents-windows/agentinstallerupdate.md). | +| ![Agents Interface - Configure Auto Deploy icon](/images/threatprevention/8.1/admin/agents/autodeployicon.webp) | Configure Auto Deploy | If enabled, the Agent is automatically deployed to all domain controllers without an Agent. This feature requires at least one Agent to be present in the domain to detect additional domain controllers. It opens the [Configure Auto Deploy Window](/docs/threatprevention/8.1/admin/agents/agents-windows/configureautodeploy.md). | +| ![Agents Interface - Agent Enrollment Secret icon](/images/threatprevention/8.1/admin/agents/enrollmentsecreticon.webp) | Agent Enrollment Secret | Generate the enrollment secret used to deploy the Agent. Opens the [Enrollment Secret Configuration Window](/docs/threatprevention/8.1/admin/agents/agents-windows/enrollmentsecretconfiguration.md). | +| ![Agents Interface - Deploy Agent icon](/images/threatprevention/8.1/admin/agents/deployagent.webp) | Deploy Agent | Deploy the Agent to selected servers. It opens the Deploy Agents wizard. See the [Deploy Agents](/docs/threatprevention/8.1/admin/agents/deploy/overview.md) topic for additional information. | + +## Right-Click Menu + +A right-click menu is available for each row in the data grid. Options not applicable to the +selected Agent are grayed-out. + +![Agents Interface - Right-Click Menu](/images/threatprevention/8.1/admin/agents/rightclickmenu.webp) + +The right-click menu contains the following selections: + +| Right-Click Command | Description | +| ------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| Install Agent | Deploys the Agent to the selected machines. Opens the Deploy Agent wizard. See the [Deploy Agents](/docs/threatprevention/8.1/admin/agents/deploy/overview.md) topic for additional information. | +| Uninstall Agent | Uninstalls a previously deployed Agent from its server. See the [Uninstall Agent](/docs/threatprevention/8.1/install/upgrade/uninstallagent.md) topic for additional information. | +| Upgrade Agent | Upgrades the Agent to a newer version. See the [Upgrade Agent](/docs/threatprevention/8.1/install/upgrade/agent.md) topic for additional information. | +| Upgrade ADMonitor | Updates the SI.ActiveDirectoryMonitor.dll (LSASS module) only rather than the entire Agent. See the [Upgrade ADMonitor](/docs/threatprevention/8.1/admin/agents/agent-management/upgradeadmonitor.md) topic for additional information. | +| Update Agent Settings | Allows for modification of the Agent settings, such as the modules, Enterprise Manager address, or enabling/disabling the DNS Host Name Resolution option. It opens the Deploy Agent wizard. See the [Update Agent Settings](/docs/threatprevention/8.1/admin/agents/deploy/overview.md#update-agent-settings) topic for additional information. | +| Start Agent | Starts the Agent service on the selected machines. See the [Start Agent](/docs/threatprevention/8.1/admin/agents/agent-management/start.md) topic for additional information. | +| Stop Agent | Stops the Agent service on the selected machines. See the [Stop Agent](/docs/threatprevention/8.1/admin/agents/agent-management/stop.md) sections for additional information. | +| Start Pending Modules | Starts Agent service modules that didn't start with the Agent due to a change in LSASS (only available on Agents configured to use Safe Mode). See the [Agent Safe Mode](/docs/threatprevention/8.1/admin/agents/safemode.md) topic and the [Start Pending Modules](/docs/threatprevention/8.1/admin/agents/agent-management/startpendingmodules.md) topic for additional information. | +| Harden Agent | Protects an Agent from being altered, stopped, or started from within the local Service Control Manager. See the [Harden Agent](/docs/threatprevention/8.1/admin/agents/agent-management/harden.md) topic for additional information. | +| Soften Agent | Unlocks the Agent so it can be controlled from within the local Service Control Manager. See the [Soften Agent](/docs/threatprevention/8.1/admin/agents/agent-management/soften.md) topic for additional information. | +| Remove Server from List | Removes a server from the Agent data grid. If the server has a deployed Agent, it will be added back to the list the next time the Agent sends information to the Enterprise Manager. See the [Remove Server from List](/docs/threatprevention/8.1/admin/agents/agent-management/removeserver.md) topic for additional information. | +| Clear SQLite Agent Queue | When the Agent is unable to communicate with the Enterprise Manager, Agent events queue up in the Agents local SQLite database until the Enterprise Manager is available to accept events. The Clear SQLite Agent Queue option dumps the queue and all pending events are lost. See the [Clear SQLite Agent Queue](/docs/threatprevention/8.1/admin/agents/agent-management/clearqueue.md) topic for additional information. | + +For certain actions, you can select multiple Agents listed in the data grid, to perform that action +on all the selected Agents. The appropriate right-click menu options will not be grayed out if +multi-selection is available for the particular action. Agents must be in the same state to +complete a multi-select action (for example, all selected Agents must be stopped to use the Start +action). + +To perform centralized Agent maintenance from the Administration Console, you must have WMI enabled +on the machine where the Agent is installed. The Soften Agent, Harden Agent, and Remove Server from +List actions are an exception. When executing the other commands, the Administration Console uses +WMI to remotely query the registry on the target Agent machines to understand where the Agent +configuration files are located (install path). Next, WMI is used to stop the Agent service, modify +the configuration files, and restart the Agent. + +See the [Firewall Ports](/docs/threatprevention/8.1/requirements/ports.md) topic for default ports required for WMI +communication. See the Microsoft +[WMI Diagnosis Utility]() +article for additional information. + +## Additional Agent Considerations + +Consider the following: + +- Occasionally a Microsoft Security Bulletin impacting LSASS can interfere with the Agent + instrumentation resulting in LSASS shutting down. The Agent is configured to monitor for an LSASS + process termination shortly after a server reboot. The + [LSASS Process Terminated](/docs/threatprevention/8.1/troubleshooting/lsass.md) alert (Operations alert) is triggered + in this event and the Agent is stopped. As a result, all monitoring/blocking by that Agent stops. + To resolve the issue, either upgrade to the latest version of the Agent or upgrade + SI.ActiveDirectoryMonitor.dll - commonly known as ADMonitor DLL (recommended). See the + [Upgrade ADMonitor](/docs/threatprevention/8.1/admin/agents/agent-management/upgradeadmonitor.md)topic for additional information. + + :::info + Activate an email notification for the _LSASS process terminated_ alert. See + the + [Enable the 'LSASS Process Terminated' Email Alert](/docs/threatprevention/8.1/troubleshooting/lsass.md#enable-the-lsass-process-terminated-email-alert) + topic for additional information. + ::: + + +- In addition to the LSASS process termination check, the Agent can be configured for a Safe Mode. + In Safe Mode, the Agent records the version of the LSASS DLLs that it hooks into during + installation. When an Agent is restarted, it compares the DLL versions with the recorded list. If + the versions don't match, the Windows AD Events monitoring module isn't loaded. The Agent’s + status in the Agents interface changes to Active (Modules Pending), and all Active Directory + monitoring/blocking by that Agent stops. The 'Agent Started in AD Monitor pending mode' alert + (Operations alert) is triggered in this event. To resolve the issue temporarily, the Threat + Prevention administrator should start the pending modules. See the + [Start Pending Modules](/docs/threatprevention/8.1/admin/agents/agent-management/startpendingmodules.md) topic for additional information. It is + also recommended to upgrade SI.ActiveDirectoryMonitor.dll (commonly known as ADMonitor DLL) to + resolve the issue permanently. See the [Upgrade ADMonitor](/docs/threatprevention/8.1/admin/agents/agent-management/upgradeadmonitor.md) + topic for additional information. + + :::info + Activate an email notification for this alert. See the + [Enable Agent Started in AD Monitor Pending Mode Email Alert](/docs/threatprevention/8.1/admin/agents/safemode.md#enable-agent-started-in-ad-monitor-pending-mode-email-alert) + topic and the [Agent Safe Mode](/docs/threatprevention/8.1/admin/agents/safemode.md) topic for additional information. + + ::: diff --git a/docs/threatprevention/8.1/admin/agents/safemode.md b/docs/threatprevention/8.1/admin/agents/safemode.md new file mode 100644 index 0000000000..e2c2553d72 --- /dev/null +++ b/docs/threatprevention/8.1/admin/agents/safemode.md @@ -0,0 +1,105 @@ +--- +title: "Agent Safe Mode" +description: "Agent Safe Mode" +sidebar_position: 10 +--- + +# Agent Safe Mode + +To collect real-time activity data, the Agent hooks into (intercepts) specific Microsoft APIs in the +LSASS process. Below are some considerations: + +- Occasionally a Microsoft Security Bulletin impacting LSASS can interfere with the Agent + instrumentation resulting in LSASS shutting down. The Agent is configured to monitor for an LSASS + process termination shortly after a server reboot. The + [LSASS Process Terminated](/docs/threatprevention/8.1/troubleshooting/lsass.md) alert (Operations alert) is triggered + in this event and the Agent is stopped. As a result, all monitoring/blocking by that Agent stops. + To resolve the issue, either upgrade to the latest version of the Agent or simply upgrade + SI.ActiveDirectoryMonitor.dll - commonly known as ADMonitor DLL (recommended). See the + [Upgrade ADMonitor](/docs/threatprevention/8.1/admin/agents/agent-management/upgradeadmonitor.md)topic for additional information. + + :::info + Activate an email notification for the _LSASS process terminated_ alert. See + the + [Enable the 'LSASS Process Terminated' Email Alert](/docs/threatprevention/8.1/troubleshooting/lsass.md#enable-the-lsass-process-terminated-email-alert) + topic for additional information. + ::: + + +- In addition to the LSASS process termination check, the Agent can be configured for a Safe Mode. + In Safe Mode, the Agent records the version of the LSASS DLLs that it hooks into during + installation. When an Agent is restarted, it compares the DLL versions with the recorded list. If + the versions do not match, the Windows AD Events monitoring module is not loaded. The Agent’s + status in the Agents interface changes to Active (Modules Pending), and all Active Directory + monitoring/blocking by that Agent stops. The 'Agent Started in AD Monitor pending mode' alert + (Operations alert) is triggered in this event. To resolve the issue temporarily, the Threat + Prevention administrator should start the pending modules. See the + [Start Pending Modules](/docs/threatprevention/8.1/admin/agents/agent-management/startpendingmodules.md) topic for additional information. It is + also recommended to upgrade SI.ActiveDirectoryMonitor.dll (commonly known as ADMonitor DLL) to + resolve the issue permanently. See the [Upgrade ADMonitor](/docs/threatprevention/8.1/admin/agents/agent-management/upgradeadmonitor.md) + topic for additional information. + + :::info + Activate an email notification for this alert. See the Enable Agent Started + in AD Monitor Pending Mode Email Alert topic for additional information. + ::: + + +:::tip +Remember, in Safe Mode, Threat Prevention does not terminate the LSASS process; it only prevents +the Active Directory monitoring/blocking module from loading on the Agent machine every time key +LSASS DLLs are changed. +::: + + +:::note +Most Microsoft Security Bulletins that alter LSASS will not interfere with Agent +instrumentation. +::: + + +Active Directory monitoring/blocking will not resume until the pending modules are started. To +determine if the LSASS changes will conflict with the Agent instrumentation, start the pending +modules on one domain controller (see the [Start Pending Modules](/docs/threatprevention/8.1/admin/agents/agent-management/startpendingmodules.md) +topic). If there are no issues after five minutes, it is unlikely that the changes are conflicting +with the Agent instrumentation. If there are any concerns about the changes, reach out to +[](mailto:support@stealthbits.com)[Netwrix Support](https://www.netwrix.com/support.html) for more +information. Netwrix tests Microsoft Security Bulletins affecting LSASS prior to their becoming +public and sends notifications to Threat Prevention users when an issue is identified. + +When the pending modules are started, the recorded versions of the LSASS DLLs the Agent hooks into +are overwritten with the current versions. + +## Enable Agent Started in AD Monitor Pending Mode Email Alert + +Follow the steps to enable email notifications for the Agent Started in AD Monitor pending mode +Operations alert. + +:::note +These steps require the Threat Prevention administrator role. They also assume that the +[System Alerting Window](/docs/threatprevention/8.1/admin/configuration/systemalerting/overview.md) has been configured and email +alerts have been enabled. +::: + + +**Step 1 –** Clck **Configuration** > **Alerts** on the menu. The Netwrix Threat Prevention System +Alerting window opens. + +**Step 2 –** On the Email tab, click **Configure**. + +**Step 3 –** Create a message profile for the Safe Mode notification with the recipient(s) to be +notified when the AD modules are pending. See the +[Create Message Profiles](/docs/threatprevention/8.1/admin/configuration/systemalerting/email.md#create-message-profiles) topic +for additional information. + +![Netwrix Threat Prevention System Alerting window](/images/threatprevention/8.1/admin/agents/adpendingmodealert.webp) + +**Step 4 –** Select **Events**, and then **Operations** on the left. Check the **Agent Started in AD +Monitor pending mode** event alert and select the message profile you created in Step 3 from the +drop-down menu to assign it to the alert. See the +[Email Tab](/docs/threatprevention/8.1/admin/configuration/systemalerting/email.md) topic for additional information. + +**Step 5 –** Ensure that the email alerts are **Enabled** and click **OK**. + +When the Agent Started in AD Monitor pending mode event alert is triggered, an email notification is +sent to the recipient(s) in the selected message profile. diff --git a/docs/threatprevention/8.1/admin/alerts/_category_.json b/docs/threatprevention/8.1/admin/alerts/_category_.json new file mode 100644 index 0000000000..e52c1d2584 --- /dev/null +++ b/docs/threatprevention/8.1/admin/alerts/_category_.json @@ -0,0 +1,10 @@ +{ + "label": "Alerts Interface", + "position": 50, + "collapsed": true, + "collapsible": true, + "link": { + "type": "doc", + "id": "overview" + } +} \ No newline at end of file diff --git a/docs/threatprevention/8.1/admin/alerts/alertscleanup.md b/docs/threatprevention/8.1/admin/alerts/alertscleanup.md new file mode 100644 index 0000000000..955cbc9b1a --- /dev/null +++ b/docs/threatprevention/8.1/admin/alerts/alertscleanup.md @@ -0,0 +1,50 @@ +--- +title: "Alerts Cleanup Window" +description: "Alerts Cleanup Window" +sidebar_position: 10 +--- + +# Alerts Cleanup Window + +You can clear alert data displayed on the [Alerts Interface](/docs/threatprevention/8.1/admin/alerts/overview.md) as well as schedule +cleanups for this data. + +:::info +Export alert data before using the Clear option. See the +[Alerts Export Window](/docs/threatprevention/8.1/admin/alerts/alertsexport.md) topic for additional information. +::: + + +Follow the steps to clear the alerts data. + +**Step 1 –** Click **Alerts** in the left pane to launch the Alerts interface. + +**Step 2 –** On the Alerts interface, click the **Clear** icon in the top right corner. + +![Alerts Cleanup window](/images/threatprevention/8.1/admin/alerts/window/alertscleanup.webp) + +**Step 3 –** The Alerts Cleanup window has these options: + +- Delete – Removes alert data from the database. Select **All** to delete all alert data or select + **Older than** and specify a certain number of days to delete alerts older than the specified + number of days. +- Log Level – Deletes alerts that have the log levels that are checked. The log levels are + equivalent to the alert severity levels in the data grid on the + [Alerts Interface](/docs/threatprevention/8.1/admin/alerts/overview.md). +- Save deleted to File – Saves alert data to a CSV file before it is deleted from the database. On + clicking Start, the Save As window appears. Specify a file name and location; the default name is + “Alerts*Backup*[date]\_[timestamp]”. Then click Save. +- Analytics Alerts – Choose to display Threat Prevention analytics alerts in the database and/or + show them in the Alerts interface. If you choose to display them on the Alerts interface, then + this data will also be deleted in the cleanup function. +- Cleanup Scheduling – Deletes alerts after a specific number of days if the severity level is + selected from the list. Set the start time for when the cleanup begins. + +**Step 4 –** Click **Start** to run the alerts cleanup with the applied settings. + +**Step 5 –** Click **Save** to save any changes or **Close** to discard the changes and close the +window. + +Threat Prevention clears alert data from the database according to these configurations. It +generates a new alert to notify that the alert data is cleared, identifies the user who cleared the +alerts, displays a date time stamp, and what options were configured for the cleanup operation. diff --git a/docs/threatprevention/8.1/admin/alerts/alertsexport.md b/docs/threatprevention/8.1/admin/alerts/alertsexport.md new file mode 100644 index 0000000000..fd43682045 --- /dev/null +++ b/docs/threatprevention/8.1/admin/alerts/alertsexport.md @@ -0,0 +1,29 @@ +--- +title: "Alerts Export Window" +description: "Alerts Export Window" +sidebar_position: 20 +--- + +# Alerts Export Window + +You can export alert data displayed on the Alerts interface to a CSV file. + +Follow the steps to export the alerts data. + +**Step 1 –** Click **Alerts** in the left pane to launch the Alerts interface. + +**Step 2 –** On the Alerts interface, click the **Export Data** icon in the top right corner; the +Alerts Export window is displayed. + +![Alerts Export window](/images/threatprevention/8.1/admin/alerts/window/export.webp) + +**Step 3 –** Export options include: + +- All – Exports all alert data +- Currently Displayed – Exports alert data according to the filters set in the data grid on the + Alerts interface +- Data Range – Exports alert data generated during the time period you specify in the **From** and + **To** boxes + +**Step 4 –** Click **OK**; the Save As window opens. Specify the file name and location, then click +**Save**. diff --git a/docs/threatprevention/8.1/admin/alerts/overview.md b/docs/threatprevention/8.1/admin/alerts/overview.md new file mode 100644 index 0000000000..f1a3e957e1 --- /dev/null +++ b/docs/threatprevention/8.1/admin/alerts/overview.md @@ -0,0 +1,124 @@ +--- +title: "Alerts Interface" +description: "Alerts Interface" +sidebar_position: 50 +--- + +# Alerts Interface + +The Alerts interface allows you to quickly view recent Security events, Operations events, and +Configuration events for Threat Prevention - all of which are known as alerts. These events are +system-generated and do not require any prior configuration. + +You can choose to view alerts related to analytics configuration and monitoring status on the Alerts +interface. See the [Alerts Cleanup Window](/docs/threatprevention/8.1/admin/alerts/alertscleanup.md) topic for options to display +this data. + +Click **Alerts** in the left pane to launch the Alerts interface. + +![Alerts interface](/images/threatprevention/8.1/admin/alerts/alertsinterface.webp) + +The following options are available on the toolbar: + +- Recent [number] Alerts radio button – Populates the data grid with the most recent alerts. Use the + textbox to change the default number of 1000. +- Alerts for Last [number] Hours radio button – Populates the data grid with hourly alert data. Use + the textbox to change the default number of three hours. +- Refresh button – Updates the data grid with the current alert data for the selected radio button + option +- Clear icon – Delete, save, and schedule cleanups for alert data +- Export Data icon – Export alerts data from this grid to a local CSV file + +Example for the Alerts for Last [number] Hours Option + +Below is an example of how to use the Alerts for Last [number] Hours option. + +The number of hours set is based on UTC and is adjusted for the time zones of the Administration +Console server and the Agent that is monitoring the events. Let's assume the following: + +- The Administration Console server is in New York, USA (UTC -5) +- The option is set to display events for Last 4 Hours +- The Agent that is monitoring the events is in London, UK (UTC +0) + +If you click the Refresh button at noon New York time, then the events displayed would have been +generated between 8 A.M. and 12 P.M. New York time, or between 1 P.M. and 5 P.M. London time. + +## Alerts Data Grid + +The data grid displays the following information for each event: + +- Time (UTC) – Date timestamp for when the system event occurred, the specified time is UTC time. + Hover over the data in this column to view the local time (of the Enterprise Manager) and UTC time + simultaneously. +- Severity – Classification of the significance of the event indicated by the alert: + - Critical – Might include data loss or other events with unexpected conditions + - Error – Indicates a situation where Threat Prevention fails to complete an operation, for + example, when it fails to connect to a SEIM server + - Warning – Indicates change events that affect the global operations of Threat Prevention + - Info – Covers all other system events +- Component – The type of system event for which the alert is triggered: + + - Threat Prevention Security events + - Threat Prevention Operations events + - Threat Prevention Configuration events + + For a list of the events that fall under each component, see the + [System Alerting Window](/docs/threatprevention/8.1/admin/configuration/systemalerting/overview.md) + +- Machine – Name of the originating host +- Alert – Name of the event that triggered the alert +- User – Security principal of the account that triggered the event +- Message – Description and details about the event. The **Policy updated on server + Changeset #[number]** link is displayed for events that represent a change to a policy, be it a + policy under the Policies node or one defined for analytics. Click it to open the + [Policy Comparison Window](/docs/threatprevention/8.1/admin/alerts/policycomparison.md) where you can view any changes made to the + policy. Alerts generated for an archive database maintenance job have "Archive DB:" as the message + prefix to differentiate them from those generated for the database maintenance job. + +This data grid employs features for sorting, filtering, searching, and more. See the +[ Data Grid Functionality](/docs/threatprevention/8.1/admin/navigation/datagrid.md) topic for additional information. + +Select an event in the data grid to view its details. + +In addition to this information, several notifications have been sent for the event. + +## Additional Considerations + +Below are some considerations: + +- Occasionally a Microsoft Security Bulletin impacting LSASS can interfere with the Agent + instrumentation resulting in LSASS shutting down. The Agent is configured to monitor for an LSASS + process termination shortly after a server reboot. The + [LSASS Process Terminated](/docs/threatprevention/8.1/troubleshooting/lsass.md) alert (Operations alert) is triggered + in this event and the Agent is stopped. As a result, all monitoring/blocking by that Agent stops. + To resolve the issue, either upgrade to the latest version of the Agent or simply upgrade + SI.ActiveDirectoryMonitor.dll - commonly known as ADMonitor DLL (recommended). See the + [Upgrade ADMonitor](/docs/threatprevention/8.1/admin/agents/agent-management/upgradeadmonitor.md)topic for additional information. + + :::info + Activate an email notification for the _LSASS process terminated_ alert. See + the + [Enable the 'LSASS Process Terminated' Email Alert](/docs/threatprevention/8.1/troubleshooting/lsass.md#enable-the-lsass-process-terminated-email-alert) + topic for additional information. + ::: + + +- In addition to the LSASS process termination check, the Agent can be configured for a Safe Mode. + In Safe Mode, the Agent records the version of the LSASS DLLs that it hooks into during + installation. When an Agent is restarted, it compares the DLL versions with the recorded list. If + the versions do not match, the Windows AD Events monitoring module is not loaded. The Agent’s + status in the Agents interface changes to Active (Modules Pending), and all Active Directory + monitoring/blocking by that Agent stops. The 'Agent Started in AD Monitor pending mode' alert + (Operations alert) is triggered in this event. To resolve the issue temporarily, the Threat + Prevention administrator should start the pending modules. See the + [Start Pending Modules](/docs/threatprevention/8.1/admin/agents/agent-management/startpendingmodules.md) topic for additional + information. It is also recommended to upgrade SI.ActiveDirectoryMonitor.dll (commonly known as + ADMonitor DLL) to resolve the issue permanently. See the + [Upgrade ADMonitor](/docs/threatprevention/8.1/admin/agents/agent-management/upgradeadmonitor.md) topic for additional information. + + :::info + Activate an email notification for this alert. See the + [Enable Agent Started in AD Monitor Pending Mode Email Alert](/docs/threatprevention/8.1/admin/agents/safemode.md#enable-agent-started-in-ad-monitor-pending-mode-email-alert) + topic and the [Agent Safe Mode](/docs/threatprevention/8.1/admin/agents/safemode.md) topic for additional information. + + ::: diff --git a/docs/threatprevention/8.1/admin/alerts/policycomparison.md b/docs/threatprevention/8.1/admin/alerts/policycomparison.md new file mode 100644 index 0000000000..97d5f09253 --- /dev/null +++ b/docs/threatprevention/8.1/admin/alerts/policycomparison.md @@ -0,0 +1,41 @@ +--- +title: "Policy Comparison Window" +description: "Policy Comparison Window" +sidebar_position: 30 +--- + +# Policy Comparison Window + +When you edit a policy, the change creates an alert in the Alerts interface. You can track the +changes made to the policy through a comparison of the new xml with the old xml. Threat Prevention +uses fc.exe to do a comparison but you can also employ a third party comparison tool for better +results. + +Follow the steps to run a comparison. + +**Step 1 –** Click **Alerts** in the left pane to launch the Alerts interface. + +**Step 2 –** On the Alerts interface, click the **Policy updated on server Changeset #[number]** +link in the Message column for an alert. The Policy Comparison window opens, where you can view the +changes made to the policy against the respective alert. + +![olicy Comparison window ](/images/threatprevention/8.1/admin/alerts/window/policycomparison.webp) + +**Step 3 –** On the Policy Comparison windowthe old xml displays on the left and the modified xml on +the right. + +**Step 4 –** _(Optional)_ Click the **Configure** icon next to the Run Different Tool button. The +File Comparison Tool window opens. In the Path to Comparison Tool box, provide the path to the file +comparison tool location in quotations. Next, add **%1 %2** after the quoted location path. for +example, _cmd.exe /K fc.exe %1 %2_. Click **OK** to close the window. + +:::note +By default, fc.exe is specified as the path but it is recommended to replace this with a +path to a Windows based comparison tool such as Beyond Compare for best results. +::: + + +**Step 5 –** On the Policy Comparison window, click **Run Difference Tool** to run the specified +compare command using the third party comparison tool. + +A window displays the policy comparison results. diff --git a/docs/threatprevention/8.1/admin/analytics/_category_.json b/docs/threatprevention/8.1/admin/analytics/_category_.json new file mode 100644 index 0000000000..0c8210da2c --- /dev/null +++ b/docs/threatprevention/8.1/admin/analytics/_category_.json @@ -0,0 +1,10 @@ +{ + "label": "Analytics Interface", + "position": 70, + "collapsed": true, + "collapsible": true, + "link": { + "type": "doc", + "id": "overview" + } +} \ No newline at end of file diff --git a/docs/threatprevention/8.1/admin/analytics/baduseridsourcehost.md b/docs/threatprevention/8.1/admin/analytics/baduseridsourcehost.md new file mode 100644 index 0000000000..8c9ea9e51b --- /dev/null +++ b/docs/threatprevention/8.1/admin/analytics/baduseridsourcehost.md @@ -0,0 +1,150 @@ +--- +title: "Bad User ID (by Source Host)" +description: "Bad User ID (by Source Host) Analytic Type" +sidebar_position: 10 +--- + +# Bad User ID (by Source Host) Analytic Type + +The **Bad User ID (by source host)** analytic type identifies pre-authentication failures due to +using account names that cannot be found in Active Directory. These incidents are grouped per source +host. Every time a previously unseen machine is the source of a failed login due to bad user name, +an incident is stored in the database. The count for the number of attempts is incremented each time +that same machine attempts to authenticate with a bad user name until the specified day limit +expires. After the time expires, any additional attempt will generate a new incident. This allows +for a report on the number of times a particular host used bad user accounts to try to login during +the time frame. + +:::info +Configure the day limit to 30 days. +::: + + +| Bad User ID (by source host) | | +| ---------------------------- | -------------------------- | +| Definition | Pre-authentication failures using one or more non-existing user IDs | +| Example | Similar to the “Bad User ID (by User)” analytic type, this analytic looks for multiple failed authentications against non-existing accounts, but from a single source host. This analytic identifies a perpetrator that hunts for accounts from a single source computer. | +| Trigger | Any number of failed authentication attempts using non-existing accounts made from a specific host | +| Recommended Settings | Bad User ID (by source host) groups attacks by where failed authentication attempts by non-existing accounts are coming from to trigger analytic hits. The user-configurable parameter is based on time, where time is used to visualize how often an attempt is made to authenticate using a non-existing account from an individual system.
Netwrix recommends setting the default value to 30 days. If a failed authentication attempt using a non-existing account occurs from the same host after the 30 day time period, a new analytic hit will be produced rather than incrementing the previous hit count. | + +**Analytic Workflow** + +1. Configure the analytic policy +2. Enable the analytic policy +3. Enable alerting on incidents through the + [System Alerting Window](/docs/threatprevention/8.1/admin/configuration/systemalerting/overview.md). + +See the Bad User ID (by Source Host) Analytic Data Grid topic for information on event data +collected per incident. + +## Configure Bad User ID (by Source Host) Analytic Policy + +Open the Bad User ID (by source host) Analytic Policy in any of the following ways: + +- Click Analytics in the left pane to launch the Analytics interface. Then click the gear icon for + the analytic. +- Expand the Analytics node and click the desired analytic. On the analytic window, click the gear + icon available in the top right corner. + +The Configure Analytics window has two tabs: + +- Settings – Where the analytic trigger is defined +- Policy – Where filters can be added, additional actions configured, a custom schedule set, and the + policy enabled + +**Settings Tab** + +![Bad User ID (by Source Host) Analytic Type - Settings tab](/images/threatprevention/8.1/admin/analytics/baduseridsettings.webp) + +Set the Number of Days for which repeated authentication attempts by a machine using a bad user +account will be tallied. An incident will be triggered for every previously unseen host that has a +bad user account attempt login. Each additional attempt for the same host will be added to the total +number of attempts through the limit of days set here, e.g. 30 days. After this number of days has +elapsed from the first attempt, a new incident will be triggered for any additional attempt with a +new count. + +**Policy Tab** + +![Bad User ID (by Source Host) Analytic Type - Policy tab](/images/threatprevention/8.1/admin/analytics/policytab.webp) + +The Policy tab for configuring analytics consists of three sub-tabs: + +- General tab – Configured the same way a regular policy’s [General Tab](/docs/threatprevention/8.1/admin/policies/configuration/general.md) is + configured. The only exception is that the Name and Description are hard coded, and cannot be + modified. The Tags field is disabled for analytics. +- Event Type tab – Configured the same way a regular policy’s + [Event Type Tab](/docs/threatprevention/8.1/admin/policies/configuration/eventtype/overview.md) is configured. The only exception is that the + [Authentication Monitoring Event Type](/docs/threatprevention/8.1/admin/policies/configuration/eventtype/authenticationmonitoring.md) is hard + coded, and the Success filter cannot be modified. Additionally, there is no AD Perpetrator filter. + + - _Optional:_ Scope the protocol to be monitored on the Authentication Protocol filter. If + enabling the analytic on a domain controller, also scope the login type. + + :::note + The Exclude failed authentications with ‘N-2’ passwords option requires a GPO + within the organization be configured to ‘Enforce password history’ with a setting of a + minimum of ‘3 passwords remembered’ or it will not have an effect. + ::: + + + - _Optional:_ Scope the domains to be included in or excluded from monitoring on the + Domains/Servers filter. + - _Optional:_ Scope the servers to be included in or excluded from monitoring on the IP + Addresses (from) filter, the IP Addresses (to) filter, the Hosts (from) filter, or the Hosts + (to) filter. + + :::note + Some authentication events may return only a host name (NetBIOS or FQDN), others + may return only an IP address. It is recommended to take this into account when entering + filter values. + ::: + + +- Actions tab – Configured the same way a regular policy’s + [Actions Tab](/docs/threatprevention/8.1/admin/policies/configuration/actions/overview.md) is configured. The only exceptions are that the + “Send to Event DB” and “Email Notifications” options are disabled. The event data collected by + analytic policies are stored in memory until an incident is triggered. For the “Send Raw Data to + SIEM” option, use _caution_, as this will send all event data not the triggered incident, which + could be a large volume of data. To send notifications on incidents, use the + [System Alerting Window](/docs/threatprevention/8.1/admin/configuration/systemalerting/overview.md) to configure Email and SIEM + alerts. + +## Bad User ID (by Source Host) Analytic Data Grid + +The data grid on the **Bad User ID (by source host)** node lists one row per incident identified. +These incidences are grouped per unique source machine. + +![Bad User ID by Source Host window](/images/threatprevention/8.1/admin/analytics/baduseridsourcehost.webp) + +The data grid can be filtered according to the Event Tracker status: All, New, or Reviewed. See the +[Event Tracker Window](/docs/threatprevention/8.1/admin/policies/configuration/recentevents/eventtracker.md) topic for additional information. + +The top data grid includes the following information for each incident: + +- Attacking Host – Name of the originating host +- Attacking Host IP Address – IP address of the originating host +- Last Attempt – Date timestamp of the last event that triggered the incident. Hover over the data + in this column to view the local time (of the Enterprise Manager) and UTC time simultaneously. +- Number of Accounts – Number of unique accounts that attempted to login from this host +- Protocols – Protocol(s) used for the monitored operation +- Number of Attempts – Number of attempts monitored during the specified interval matching this rule +- Number of Hosts – Number of hosts accessed during the specified interval matching this rule + +Select an incident in the top data grid to view information on the events that triggered the +incident: + +- Account Name – Name of the bad user account that attempted to login +- To Host – Name of the target host +- To Host IP Address – IP address of the target host +- Protocol – Protocol(s) used for the monitored operation +- Access Type – Type of authentication, e.g. RDP, CIFS, etc. +- Status – Detailed information on the error generated by the event +- Detected on DC – Fully-qualified name of the domain controller that detected the event +- Events Count – Number of identical events that occurred in one minute +- Date/Time – Date timestamp of the monitored event. Hover over the data in this column to view the + local time (of the Enterprise Manager) and UTC time simultaneously. +- Agent Time Logged – Timestamp for when the Agent detected the event. This can be different from + the Enterprise Manager time (displayed in the Date/Time column) due to latency. + +This data grid employs features for sorting, filtering, searching, and more. See the +[ Data Grid Functionality](/docs/threatprevention/8.1/admin/navigation/datagrid.md) topic for additional information. diff --git a/docs/threatprevention/8.1/admin/analytics/baduseriduser.md b/docs/threatprevention/8.1/admin/analytics/baduseriduser.md new file mode 100644 index 0000000000..e39bc37985 --- /dev/null +++ b/docs/threatprevention/8.1/admin/analytics/baduseriduser.md @@ -0,0 +1,148 @@ +--- +title: "Bad User ID (by User)" +description: "Bad User ID (by User) Analytic Type" +sidebar_position: 20 +--- + +# Bad User ID (by User) Analytic Type + +The **Bad User ID (by user)** analytic type identifies pre-authentication failures due to using +account names that cannot be found in Active Directory. These incidents are grouped per account +name. Every time a previously unseen user that does not exist attempts to login within the specified +day limit, an incident is stored in the database. The count for the number of attempts is +incremented each time that same bad user account attempts to login until the specified day limit +expires. After the time expires, any additional attempt will generate a new incident. This allows +for a report on the number of times a particular bad user account tried to login during the time +frame. + +:::info +Configure the day limit to 30 days. +::: + + +| Bad User ID (by user) | | +| --------------------- | ---------------------- | +| Definition | Pre-authentication failures using one or more non-existing user IDs | +| Example | Malware or a bad-actor is attempting to obtain access by guessing a user ID and password but has provided a user ID that does not exist. Most operating systems and devices have default administrative accounts such as “administrator” or “admin”. Because the account name is known, if left unchanged, the account becomes vulnerable to attack. To prevent this, most organizations change the name of these accounts. In the case where the account has been renamed, a perpetrator attempting to hack a well-known account will actually be attempting to authenticate against an account that does not exist and will be detected by this analytic. This analytic looks for attacks, regardless of source, against non-existing accounts. | +| Trigger | Any number of failed authentication attempts made by a non-existing account | +| Recommended Settings | Bad User ID (by user) groups attacks by account name where every new non-existing account will generate an analytic hit. The user-configurable parameter is based on time, where time is used to visualize how often an attempt is made to authenticate using the same non-existing account name.
Netwrix recommends setting the default value to 30 days. If an attempt to use that same non-existing account name occurs after the 30 day time period, a new analytic hit will be produced rather than incrementing the previous hit count. | + +**Analytic Workflow** + +1. Configure the analytic policy +2. Enable the analytic policy +3. Enable alerting on incidents through the + [System Alerting Window](/docs/threatprevention/8.1/admin/configuration/systemalerting/overview.md). + +See the Bad User ID (by User) Analytic Data Grid topic for information on event data collected per +incident. + +## Configure Bad User ID (by User) Analytic Policy + +Open the Bad User ID (by user) Analytic Policy in any of the following ways: + +- Click Analytics in the left pane to launch the Analytics interface. Then click the gear icon for + the analytic. +- Expand the Analytics node and click the desired analytic. On the analytic window, click the gear + icon available in the top right corner. + +The Configure Analytics window has two tabs: + +- Settings – Where the analytic trigger is defined +- Policy – Where filters can be added, additional actions configured, a custom schedule set, and the + policy enabled + +**Settings Tab** + +![Bad User ID (by User) Analytic Type - Settings tab](/images/threatprevention/8.1/admin/analytics/baduseridsettings.webp) + +Set the **Number of Days** for which repeated use of the same bad user account will be tallied. An +incident will be triggered for every previously unseen bad user account that attempts login. Each +additional attempt for the same bad user account will be added to the total number of attempts +through the limit of days set here, e.g. 30 days. After this number of days has elapsed from the +first attempt, a new incident will be triggered for any additional attempt with a new count. + +**Policy Tab** + +![Bad User ID (by User) Analytic Type - Policy tab](/images/threatprevention/8.1/admin/analytics/policytab.webp) + +The **Policy** tab for configuring analytics consists of three sub-tabs: + +- General tab – Configured the same way a regular policy’s [General Tab](/docs/threatprevention/8.1/admin/policies/configuration/general.md) is + configured. The only exception is that the Name and Description are hard coded, and cannot be + modified. The Tags field is disabled for analytics. +- Event Type tab – Configured the same way a regular policy’s + [Event Type Tab](/docs/threatprevention/8.1/admin/policies/configuration/eventtype/overview.md) is configured. The only exception is that the + [Authentication Monitoring Event Type](/docs/threatprevention/8.1/admin/policies/configuration/eventtype/authenticationmonitoring.md) is hard + coded, and the Success filter cannot be modified. Additionally, there is no AD Perpetrator filter. + + - *Optional:* Scope the protocol to be monitored on the Authentication Protocol filter. If + enabling the analytic on a domain controller, also scope the login type. + + :::note + The Exclude failed authentications with ‘N-2’ passwords option requires a GPO + within the organization be configured to ‘Enforce password history’ with a setting of a + minimum of ‘3 passwords remembered’ or it will not have an effect. + ::: + + + - _Optional:_ Scope the domains to be included in or excluded from monitoring on the + Domains/Servers filter. + - _Optional:_ Scope the servers to be included in or excluded from monitoring on the IP + Addresses (from) filter, the IP Addresses (to) filter, the Hosts (from) filter, or the Hosts + (to) filter. + + :::note + Some authentication events may return only a host name (NetBIOS or FQDN), others + may return only an IP address. It is recommended to take this into account when entering + filter values. + ::: + + +- Actions tab – Configured the same way a regular policy’s + [Actions Tab](/docs/threatprevention/8.1/admin/policies/configuration/actions/overview.md) is configured. The only exceptions are that the + “Send to Event DB” and “Email Notifications” options are disabled. The event data collected by + analytic policies are stored in memory until an incident is triggered. For the “Send Raw Data to + SIEM” option, use _caution_, as this will send all event data not the triggered incident, which + could be a large volume of data. To send notifications on incidents, use the + [System Alerting Window](/docs/threatprevention/8.1/admin/configuration/systemalerting/overview.md) to configure Email and SIEM + alerts. + +## Bad User ID (by User) Analytic Data Grid + +The data grid on the **Bad User ID (by user)** node lists one row per incident identified. These +incidences are grouped per unique bad user name. + +![Bad User ID (by User) Analytic Type window](/images/threatprevention/8.1/admin/analytics/baduseriduser.webp) + +The data grid can be filtered according to the Event Tracker status: All, New, or Reviewed. See the +[Event Tracker Window](/docs/threatprevention/8.1/admin/policies/configuration/recentevents/eventtracker.md) topic for additional information. + +The top data grid includes the following information for each incident: + +- Account Name – Name of the bad user account that attempted to login +- Last Attempt – Date timestamp of the last event that triggered the incident. Hover over the data + in this column to view the local time (of the Enterprise Manager) and UTC time simultaneously. +- Protocols – Protocol(s) used for the monitored operation +- Number of Attempts – Number of attempts monitored during the specified interval matching this rule +- Number of Hosts – Number of hosts accessed during the specified interval matching this rule + +Select an incident in the top data grid to view information on the events that triggered the +incident: + +- From Host – Name of the originating host +- From Host IP Address – IP address of the originating host +- To Host – Name of the target host +- To Host IP Address – IP address of the target host +- Protocol – Protocol(s) used for the monitored operation +- Access Type – Type of authentication, e.g. RDP, CIFS, etc. +- Status – Detailed information on the error generated by the event +- Detected on DC – Fully-qualified name of the domain controller that detected the event +- Events Count – Number of identical events that occurred in one minute +- Date/Time – Date timestamp of the monitored event. Hover over the data in this column to view the + local time (of the Enterprise Manager) and UTC time simultaneously. +- Agent Time Logged – Timestamp for when the Agent detected the event. This can be different from + the Enterprise Manager time (displayed in the Date/Time column) due to latency. + +This data grid employs features for sorting, filtering, searching, and more. See the +[ Data Grid Functionality](/docs/threatprevention/8.1/admin/navigation/datagrid.md) topic for additional information. diff --git a/docs/threatprevention/8.1/admin/analytics/breachedpassword.md b/docs/threatprevention/8.1/admin/analytics/breachedpassword.md new file mode 100644 index 0000000000..1f1a9b5364 --- /dev/null +++ b/docs/threatprevention/8.1/admin/analytics/breachedpassword.md @@ -0,0 +1,157 @@ +--- +title: "Breached Password" +description: "Breached Password Analytic Type" +sidebar_position: 30 +--- + +# Breached Password Analytic Type + +The **Breached Password** analytic type identifies multiple failed authentications followed by a +successful authentication in the specified time frame. + +| Breached Password | | +| -------------------- | ---------------------- | +| Definition | Multiple failed authentications followed by a successful authentication | +| Example | This analytic alert may follow one or more alerts identifying repeated failed authentications against an account. This alert is of special importance as it signals that an attacked account may have been breached and a successful login occurred. This could also identify a scenario where an attacker has attempted multiple authentications with a user’s account but has failed, and then subsequent to that, the real user logs in and authenticates successfully. | +| Trigger | X failed authentication attempts from the same account followed by a successful authentication in Y hours | +| Recommended Settings | Netwrix recommends configuring this analytic to trigger a hit if Threat Prevention monitors at least 30 failed authentication attempts from the same account followed by a successful authentication in 4 hours. | + +**Analytic Workflow** + +1. Configure the analytic policy +2. Enable the analytic policy +3. Enable alerting on incidents through the + [System Alerting Window](/docs/threatprevention/8.1/admin/configuration/systemalerting/overview.md). + +See the Breached Password Analytic Data Grid topic for information on event data collected per +incident. + +## Configure Breached Password Analytic Policy + +Open the Breached Password Analytic Policy in any of the following ways: + +- Click Analytics in the left pane to launch the Analytics interface. Then click the gear icon for + the analytic. +- Expand the Analytics node and click the desired analytic. On the analytic window, click the gear + icon available in the top right corner. + +The Configure Analytics window has two tabs: + +- Settings – Where the analytic trigger is defined +- Policy – Where filters can be added, additional actions configured, a custom schedule set, and the + policy enabled + +**Settings Tab** + +![Breached Password Analytic Type - Settings tab](/images/threatprevention/8.1/admin/analytics/breachedpasswordsettings.webp) + +Set the Number of Failed Attempts preceding a successful login and the Interval Duration that will +trigger the incident. The interval duration is set for (Hours:Minutes) and is capped at 23:59. When +the specified number of failed login attempts for an individual user account precede a successful +login within the specified interval duration, it will trigger an incident record. + +By default, authentication event data is cached in memory for 24 hours. When an incident is +triggered, an incident record is saved to the database along with the events that triggered the +incident. Raw authentication event data that did not contribute to an incident are purged from +memory once they are more than 24 hours old. + +**Policy Tab** + +![Breached Password Analytic Type - Policy tab](/images/threatprevention/8.1/admin/analytics/policytab.webp) + +The **Policy** tab for configuring analytics consists of three sub-tabs: + +- General tab – Configured the same way a regular policy’s [General Tab](/docs/threatprevention/8.1/admin/policies/configuration/general.md) is + configured. The only exception is that the Name and Description are hard coded, and cannot be + modified. The Tags field is disabled for analytics. +- Event Type tab – Configured the same way a regular policy’s + [Event Type Tab](/docs/threatprevention/8.1/admin/policies/configuration/eventtype/overview.md) is configured. The only exception is that the + [Authentication Monitoring Event Type](/docs/threatprevention/8.1/admin/policies/configuration/eventtype/authenticationmonitoring.md) is hard + coded, and the Success filter cannot be modified. + + - Scope the protocol to be monitored on the Authentication Protocol filter. If enabling the + analytic on a domain controller, also scope the login type. + + :::note + The Exclude failed authentications with ‘N-2’ passwords option requires a GPO + within the organization be configured to ‘Enforce password history’ with a setting of a + minimum of ‘3 passwords remembered’ or it will not have an effect. + ::: + + + - _Optional:_ Scope the domains to be included in or excluded from monitoring on the + Domains/Servers filter. + - _Optional:_ Scope the accounts to include in or exclude from being monitored on the AD + Perpetrator filter. + - _Optional:_ Scope the servers to be included in or excluded from monitoring on the IP + Addresses (from) filter, the IP Addresses (to) filter, the Hosts (from) filter, or the Hosts + (to) filter. + + :::note + Some authentication events may return only a host name (NetBIOS or FQDN), others + may return only an IP address. It is recommended to take this into account when entering + filter values. + ::: + + +- Actions tab – Configured the same way a regular policy’s + [Actions Tab](/docs/threatprevention/8.1/admin/policies/configuration/actions/overview.md) is configured. The only exceptions are that the + “Send to Event DB” and “Email Notifications” options are disabled. The event data collected by + analytic policies are stored in memory until an incident is triggered. For the “Send Raw Data to + SIEM” option, use _caution_, as this will send all event data not the triggered incident, which + could be a large volume of data. To send notifications on incidents, use the + [System Alerting Window](/docs/threatprevention/8.1/admin/configuration/systemalerting/overview.md) to configure Email and SIEM + alerts. + +## Breached Password Analytic Data Grid + +The data grid on the **Breached Password** node lists one row per incident identified. + +![Breached Password Analytic Type window](/images/threatprevention/8.1/admin/analytics/breachedpassword.webp) + +The data grid can be filtered according to the Event Tracker status: All, New, or Reviewed. See the +[Event Tracker Window](/docs/threatprevention/8.1/admin/policies/configuration/recentevents/eventtracker.md) topic for additional information. + +The top data grid includes the following information for each incident: + +- Attacked Account Name – Security principal of the account affected by the event + + :::note + The name will be red if the attacking account is the Administrator account. + ::: + + +- Attacked Account SID – Security Identifier of the account used in the event that was attacked +- First Failed Attempt – Date timestamp of the first monitored event that triggered the incident. + Hover over the data in this column to view the local time (of the Enterprise Manager) and UTC time + simultaneously. +- Last Failed Attempt – Date timestamp of the last event that triggered the incident. Hover over the + data in this column to view the local time (of the Enterprise Manager) and UTC time + simultaneously. +- Breach Date – Date timestamp of the first monitored event that was successful. Hover over the data + in this column to view the local time (of the Enterprise Manager) and UTC time simultaneously. +- Breach Source Host – Name of the originating host +- Breach Source Host IP Address – IP address of the originating host +- Protocols – Protocol(s) used for the monitored operation +- Number of Attempts – Number of attempts monitored during the specified interval matching this rule +- Number of Hosts – Number of hosts accessed during the specified interval matching this rule + +Select an incident in the top data grid to view information on the events thath triggered the +incident: + +- From Host – Name of the originating host +- From Host IP Address – IP address of the originating host +- To Host – Name of the target host +- To Host IP Address – IP address of the target host +- Protocol – Protocol(s) used for the monitored operation +- Access Type – Type of authentication, e.g. RDP, CIFS, etc. +- Status – Detailed information on the error generated by the event +- Detected on DC – Fully-qualified name of the domain controller that detected the event +- Events Count – Number of identical events that occurred in one minute +- Date/Time – Date timestamp of the monitored event. Hover over data in this column to view Local + time (of the Enterprise Manager) and UTC time simultaneously. +- Agent Time Logged – Timestamp for when the Agent detected the event. This can be different from + the Enterprise Manager time (displayed in the Date/Time column) due to latency. + +This data grid employs features for sorting, filtering, searching, and more. See the +[ Data Grid Functionality](/docs/threatprevention/8.1/admin/navigation/datagrid.md) topic for additional information. diff --git a/docs/threatprevention/8.1/admin/analytics/bruteforceattacks.md b/docs/threatprevention/8.1/admin/analytics/bruteforceattacks.md new file mode 100644 index 0000000000..48ce25801a --- /dev/null +++ b/docs/threatprevention/8.1/admin/analytics/bruteforceattacks.md @@ -0,0 +1,156 @@ +--- +title: "Brute Force Attacks" +description: "Brute Force Attacks Analytic Type" +sidebar_position: 40 +--- + +# Brute Force Attacks Analytic Type + +The **Brute Force Attacks** analytic type identifies failed attempts from a single host to access a +given host. + +:::info +Configure a subset of servers to be monitored in order to avoid the excessive +volume of event activity from monitoring all servers. +::: + + +| Brute Force Attacks | | +| -------------------- | ---------------------- | +| Definition | Repeated failed authentications against systems and other network assets in a specified time range | +| Example | Malware or a bad actor on the network is attempting to gain access to a system, application, or data resource such as a file share by sequentially leveraging multiple user accounts and their credentials until they gain access | +| Trigger | X failed logins from a single host against a single host in Y minutes | +| Recommended Settings | Configure this analytic to trigger a hit if Threat Prevention monitors at least 40 failed logins from a single host against a single host in 3 minutes. | + +**Analytic Workflow** + +1. Configure the analytic policy +2. Enable the analytic policy +3. Enable alerting on incidents through the + [System Alerting Window](/docs/threatprevention/8.1/admin/configuration/systemalerting/overview.md). + +See the Brute Force Attacks Analytic Data Grid topic for information on event data collected per +incident. + +## Configure Brute Force Attacks Analytic Policy + +Open the Brute Force Attacks Analytic Policy in any of the following ways: + +- Click Analytics in the left pane to launch the Analytics interface. Then click the gear icon for + the analytic. +- Expand the Analytics node and click the desired analytic. On the analytic window, click the gear + icon available in the top right corner. + +The Configure Analytics window has two tabs: + +- Settings – Where the analytic trigger is defined +- Policy – Where filters can be added, additional actions configured, a custom schedule set, and the + policy enabled + +**Settings Tab** + +![Brute Force Attacks Analytic Type - Settings tab](/images/threatprevention/8.1/admin/analytics/bruteforceattackssettings.webp) + +Set the Number of Failed Attempts preceding a successful login and the Interval Duration that will +trigger the incident. The interval duration is set for (Hours:Minutes) and is capped at 23:59. When +the specified number of failed logins have occurred from a single host against a single host within +the specified interval duration, it will trigger an incident record. + +By default, authentication event data is cached in memory for 24 hours. When an incident is +triggered, an incident record is saved to the database along with the events that triggered the +incident. Raw authentication event data that did not contribute to an incident are purged from +memory once they are more than 24 hours old. + +Click the **Configure Hosts** link to open the **Policy** > **Event Type** > **Hosts (to)** filter. + +If checked, the **Ignore failed logins for unresolved user names** option will exclude bad user IDs +from contributing to Brute Force Attacks incidents. + +**Policy Tab** + +![Brute Force Attacks Analytic Type - Policy tab](/images/threatprevention/8.1/admin/analytics/policytab.webp) + +The **Policy** tab for configuring analytics consists of three sub-tabs: + +- General tab – Configured the same way a regular policy’s [General Tab](/docs/threatprevention/8.1/admin/policies/configuration/general.md) is + configured. The only exception is that the Name and Description are hard coded, and cannot be + modified. The Tags field is disabled for analytics. +- Event Type tab – Configured the same way a regular policy’s + [Event Type Tab](/docs/threatprevention/8.1/admin/policies/configuration/eventtype/overview.md) is configured. The only exception is that the + [Authentication Monitoring Event Type](/docs/threatprevention/8.1/admin/policies/configuration/eventtype/authenticationmonitoring.md) is hard + coded, and the Success filter cannot be modified. + + - Scope the servers to be included in or excluded from monitoring on the IP Addresses (from) + filter, the IP Addresses (to) filter, the Hosts (from) filter, or the Hosts (to) filter. + + :::note + Some authentication events may return only a host name (NetBIOS or FQDN), others + may return only an IP address. It is recommended to take this into account when entering + filter values. + ::: + + + - *Alternatively:* Scope the domains to be included in or excluded from monitoring on the + Domains/Servers filter. + - _Optional:_ Scope the protocol to be monitored on the Authentication Protocol filter. If + enabling the analytic on a domain controller, also scope the login type. + + :::note + The Exclude failed authentications with ‘N-2’ passwords option requires a GPO + within the organization be configured to ‘Enforce password history’ with a setting of a + minimum of ‘3 passwords remembered’ or it will not have an effect. + ::: + + + - _Optional:_ Scope the accounts to include in or exclude from being monitored on the AD + Perpetrator filter. + +- Actions tab – Configured the same way a regular policy’s + [Actions Tab](/docs/threatprevention/8.1/admin/policies/configuration/actions/overview.md) is configured. The only exceptions are that the + “Send to Event DB” and “Email Notifications” options are disabled. The event data collected by + analytic policies are stored in memory until an incident is triggered. For the “Send Raw Data to + SIEM” option, use _caution_, as this will send all event data not the triggered incident, which + could be a large volume of data. To send notifications on incidents, use the + [System Alerting Window](/docs/threatprevention/8.1/admin/configuration/systemalerting/overview.md) to configure Email and SIEM + alerts. + +## Brute Force Attacks Analytic Data Grid + +The data grid on the **Brute Force Attacks** node lists one row per incident identified. + +![Brute Force Attacks Analytic Type window](/images/threatprevention/8.1/admin/analytics/bruteforce.webp) + +The data grid can be filtered according to the Event Tracker status: All, New, or Reviewed. See the +[Event Tracker Window](/docs/threatprevention/8.1/admin/policies/configuration/recentevents/eventtracker.md) topic for additional information. + +The top data grid includes the following information for each incident: + +- Attacking Host – Name of the originating host +- Attacking Host IP Address – IP address of the originating host +- Attacked Host – Name of the target host +- Attacked Host IP Address – IP address of the target host +- First Attempt – Date timestamp of the first monitored event that triggered the incident. Hover + over the data in this column to view the local time (of the Enterprise Manager) and UTC time + simultaneously. +- Last Attempt – Date timestamp of the last event that triggered the incident. Hover over the data + in this column to view the local time (of the Enterprise Manager) and UTC time simultaneously. +- Number of Attempts – Number of attempts monitored during the specified interval matching this rule +- Protocols – Protocol(s) used for the monitored operation + +Select an incident in the top data grid to view information on the events that triggered the +incident: + +- Account – Security principal of the account that triggered the event +- Account SID – Security Identifier of the account used in the event +- Protocol – Protocol(s) used for the monitored operation +- Access Type – Type of authentication, e.g. RDP, CIFS, etc. +- Status – Detailed information on the error generated by the event +- Detected on DC – Fully-qualified name of the domain controller that detected the event +- Events Count – Number of identical events that occurred in one minute +- Date/Time – Date timestamp of the monitored event. Hover over the data in this column to view the + local time (of the Enterprise Manager) and UTC time simultaneously. +- Agent Time Logged – Timestamp for when the Agent detected the event. This can be different from + the Enterprise Manager time (displayed in the Date/Time column) due to latency. + +This data grid employs features for sorting, filtering, searching, and more. See the +[ Data Grid Functionality](/docs/threatprevention/8.1/admin/navigation/datagrid.md) topic for additional information. diff --git a/docs/threatprevention/8.1/admin/analytics/concurrentlogins.md b/docs/threatprevention/8.1/admin/analytics/concurrentlogins.md new file mode 100644 index 0000000000..862f37dba9 --- /dev/null +++ b/docs/threatprevention/8.1/admin/analytics/concurrentlogins.md @@ -0,0 +1,160 @@ +--- +title: "Concurrent Logins" +description: "Concurrent Logins Analytic Type" +sidebar_position: 50 +--- + +# Concurrent Logins Analytic Type + +The **Concurrent Logins** analytic type identifies same account logins from multiple locations +within the specified time frame. + +:::info +Configure a subset of accounts and/or servers to be monitored in order to avoid +the excessive volume of event activity from monitoring all. +::: + + +| Concurrent Logins | | +| -------------------- | ---------------------------- | +| Definition | Logins from multiple locations simultaneously | +| Example | A user does not normally login from multiple locations simultaneously within a short time window. If one or more accounts has been compromised by malware, or in the event of an insider attack, one might see a compromised account authenticating from many systems in parallel and a corresponding analytic alert identifying the account and the authenticating systems. | +| Trigger | Successful and failed authentications using the same account from at least X hosts in Y minutes | +| Recommended Settings | Netwrix recommends configuring this analytic to trigger a hit if Threat Prevention monitors either successful or failed authentications using the same account from at least 3 hosts in 1 hour. | + +**Analytic Workflow** + +1. Configure the analytic policy +2. Enable the analytic policy +3. Enable alerting on incidents through the + [System Alerting Window](/docs/threatprevention/8.1/admin/configuration/systemalerting/overview.md). + +See the Concurrent Logins Analytic Data Grid topic for information on event data collected per +incident. + +## Configure Concurrent Logins Analytic Policy + +Open the Concurrent Logins Analytic Policy in any of the following ways: + +- Click Analytics in the left pane to launch the Analytics interface. Then click the gear icon for + the analytic. +- Expand the Analytics node and click the desired analytic. On the analytic window, click the gear + icon available in the top right corner. + +The Configure Analytics window has two tabs: + +- Settings – Where the analytic trigger is defined +- Policy – Where filters can be added, additional actions configured, a custom schedule set, and the + policy enabled + +**Settings Tab** + +![Concurrent Logins Analytic Type - Settings tab](/images/threatprevention/8.1/admin/analytics/concurrentloginssettings.webp) + +Set the Number of Hosts and the Interval Duration that will trigger the incident. The interval +duration is set for (Hours:Minutes) and is capped at 23:59. When the specified number of hosts have +successful logins by the same individual user account within the specified interval duration, it +will trigger an incident record. + +By default, authentication event data is cached in memory for 24 hours. When an incident is +triggered, an incident record is saved to the database along with the events that triggered the +incident. Raw authentication event data that did not contribute to an incident are purged from +memory once they are more than 24 hours old. + +**Policy Tab** + +![Concurrent Logins Analytic Type - Policy tab](/images/threatprevention/8.1/admin/analytics/policytab.webp) + +The **Policy** tab for configuring analytics consists of three sub-tabs: + +- General tab – Configured the same way a regular policy’s [General Tab](/docs/threatprevention/8.1/admin/policies/configuration/general.md) is + configured. The only exception is that the Name and Description are hard coded, and cannot be + modified. The Tags field is disabled for analytics. +- Event Type tab – Configured the same way a regular policy’s + [Event Type Tab](/docs/threatprevention/8.1/admin/policies/configuration/eventtype/overview.md) is configured. The only exception is that the + [Authentication Monitoring Event Type](/docs/threatprevention/8.1/admin/policies/configuration/eventtype/authenticationmonitoring.md) is hard + coded, and the Success filter cannot be modified. + + - _Optional:_ Scope the protocol to be monitored on the Authentication Protocol filter. If + enabling the analytic on a domain controller, also scope the login type. + + :::note + The Exclude failed authentications with ‘N-2’ passwords option requires a GPO + within the organization be configured to ‘Enforce password history’ with a setting of a + minimum of ‘3 passwords remembered’ or it will not have an effect. + ::: + + + - _Optional:_ Scope the domains to be included in or excluded from monitoring on the + Domains/Servers filter. + - _Optional:_ Scope the accounts to include in or exclude from being monitored on the AD + Perpetrator filter. + - _Optional:_ Scope the servers to be included in or excluded from monitoring on the IP + Addresses (from) filter, the IP Addresses (to) filter, the Hosts (from) filter, or the Hosts + (to) filter. + + :::note + Some authentication events may return only a host name (NetBIOS or FQDN), others + may return only an IP address. It is recommended to take this into account when entering + filter values. + ::: + + +- Actions tab – Configured the same way a regular policy’s + [Actions Tab](/docs/threatprevention/8.1/admin/policies/configuration/actions/overview.md) is configured. The only exceptions are that the + “Send to Event DB” and “Email Notifications” options are disabled. The event data collected by + analytic policies are stored in memory until an incident is triggered. For the “Send Raw Data to + SIEM” option, use _caution_, as this will send all event data not the triggered incident, which + could be a large volume of data. To send notifications on incidents, use the + [System Alerting Window](/docs/threatprevention/8.1/admin/configuration/systemalerting/overview.md) to configure Email and SIEM + alerts. + +## Concurrent Logins Analytic Data Grid + +The data grid on the **Concurrent Logins** node lists one row per incident identified. + +![Concurrent Logins Analytic Type window](/images/threatprevention/8.1/admin/analytics/concurrentlogins.webp) + +The data grid can be filtered according to the Event Tracker status: All, New, or Reviewed. See the +[Event Tracker Window](/docs/threatprevention/8.1/admin/policies/configuration/recentevents/eventtracker.md) topic for additional information. + +The top data grid includes the following information for each incident: + +- Attacking Account Name – Security principal of the account that triggered the incident + + :::note + The name will be red if the attacking account is the Administrator account. + ::: + + +- Attacking Account SID – Security Identifier of the account used in the event that triggered the + incident +- Number of Attacking Hosts – Number of hosts the account used during the specified interval + matching this rule +- First Attempt – Date timestamp of the first monitored event that triggered the incident. Hover + over the data in this column to view the local time (of the Enterprise Manager) and UTC time + simultaneously. +- Last Attempt – Date timestamp of the last event that triggered the incident. Hover over the data + in this column to view the local time (of the Enterprise Manager) and UTC time simultaneously. +- Protocols – Protocol(s) used for the monitored operation +- Number of Attempts – Number of attempts monitored during the specified interval matching this rule + +Select an incident in the top data grid to view information on the events that triggered the +incident: + +- From Host – Name of the originating host +- From Host IP Address – IP address of the originating host +- To Host – Name of the target host +- To Host IP Address – IP address of the target host +- Protocol – Protocol(s) used for the monitored operation +- Access Type – Type of authentication, e.g. RDP, CIFS, etc. +- Status – Detailed information on the error generated by the event +- Detected on DC – Fully-qualified name of the domain controller that detected the event +- Events Count – Number of identical events that occurred in one minute +- Date/Time – Date timestamp of the monitored event. Hover over the data in this column to view the + local time (of the Enterprise Manager) and UTC time simultaneously. +- Agent Time Logged – Timestamp for when the Agent detected the event. This can be different from + the Enterprise Manager time (displayed in the Date/Time column) due to latency. + +This data grid employs features for sorting, filtering, searching, and more. See the +[ Data Grid Functionality](/docs/threatprevention/8.1/admin/navigation/datagrid.md) topic for additional information. diff --git a/docs/threatprevention/8.1/admin/analytics/filesystemattacksuser.md b/docs/threatprevention/8.1/admin/analytics/filesystemattacksuser.md new file mode 100644 index 0000000000..b9eeb1be0a --- /dev/null +++ b/docs/threatprevention/8.1/admin/analytics/filesystemattacksuser.md @@ -0,0 +1,230 @@ +--- +title: "File System Attacks (by User)" +description: "File System Attacks (by User) Analytic Type" +sidebar_position: 60 +--- + +# File System Attacks (by User) Analytic Type + +The **File System Attacks (by user)** analytic type identifies activity where a significant number +of file changes made by an account occurred in a short time period. Only the paths you select will +be monitored. It is **REQUIRED** to configure at least one path to enable this analytic. Selected +paths are specific to the server for which they were selected. + +If desired, the analytic can be configured to lockdown the monitored file system resource from +‘perpetrators’ who trigger an incident. This feature is only available on Windows file systems. + +| File System Attacks (by user) | | +| ----------------------------- | ------------------------ | +| Definition | Significant number of file changes made by an account in a short time period. Optionally block the perpetrator that triggers an incident by selecting the Enable Automatic Lockdown option. | +| Example | Malware or a bad actor is attempting to delete/modify (such as encrypt) or copy large numbers of files residing locally or on the network, in order to prevent access to or steal file system data. In the case of a ransomware attack, end user files are typically targeted (such as documents, spreadsheets, presentations, etc.), which is followed by a warning to pay a ransom or the files will be erased. This analytic will identify unusual/abnormally high levels of file activity in a short timeframe, and trigger a file system attack alert as a result. | +| Trigger | X number of files changed by an account in Y minutes | +| Recommended Settings | Netwrix recommends configuring this analytic to trigger a hit if Threat Prevention monitors 500 files affected in 3 minutes. | + +**Analytic Workflow** + +1. Configure the analytic policy +2. Enable the analytic policy +3. Enable alerting on incidents through the + [System Alerting Window](/docs/threatprevention/8.1/admin/configuration/systemalerting/overview.md). + +See the File System Attacks (by User) Analytic Data Grid topic for information on event data +collected per incident. + +## Configure File System Attacks (by User) Analytic Policy + +Open the File System Attacks (by user) Analytic Policy in any of the following ways: + +- Click Analytics in the left pane to launch the Analytics interface. Then click the gear icon for + the analytic. +- Expand the Analytics node and click the desired analytic. On the analytic window, click the gear + icon available in the top right corner. + +The Configure Analytics window has two tabs: + +- Settings – Where the analytic trigger is defined +- Policy – Where filters can be added, additional actions configured, a custom schedule set, and the + policy enabled + +**Settings Tab** + +![File System Attacks (by User) Analytic Type - Settings tab](/images/threatprevention/8.1/admin/analytics/filesystemattackssettings.webp) + +Set the Number of Accessed Files and the Interval Duration that will trigger the incident. The +interval duration is set for (Hours:Minutes) and is capped at 1:00. When a particular user causes +the specified number of file changes to occur within the specified interval duration, it will +trigger an incident record. + +By default, file event data is cached in memory for 1 hour. When an incident is triggered, an +incident record is saved to the database along with the events that triggered the incident. Raw file +event data that did not contribute to an incident are purged from memory once they are more than 1 +hour old. + +After an incident has been triggered, the next event will reset the interval timer. The event data +will continue to be added to the incident until the incident is closed. An incident is only closed +once no additional file event data arrives within the specified timeframe. + +The File System Attacks (by user) Analytic Policy can be configured to enable automatic blocking of +perpetrators who trigger an incident. Check the Enable Automatic Lockdown box and click **Save**. +This will add the File System Lockdown Event Type to the analytic policy. After enabling this +feature, the **Modify Lockdown Perpetrators** link will redirect you to the **Policy** > **Event +Type: File System Lockdown** > **AD Perpetrator (for Lockdown)** filter. As incidents occur, +perpetrators of the triggering events will be added to the AD Perpetrators (for Lockdown) filter +list and blocked from initiating future events. + +**Policy Tab for Monitoring Only** + +![File System Attacks (by User) Analytic Type - Policy tab for Monitoring Only](/images/threatprevention/8.1/admin/analytics/policytabfsmonitoring.webp) + +The **Policy** tab for configuring analytics consists of the following sub-tabs: + +- General tab – Configured the same way a regular policy’s [General Tab](/docs/threatprevention/8.1/admin/policies/configuration/general.md) is + configured. The only exception is that the Name and Description are hard coded, and cannot be + modified. The Tags field is disabled for analytics. +- Event Type tab – Configured the same way a regular policy’s + [Event Type Tab](/docs/threatprevention/8.1/admin/policies/configuration/eventtype/overview.md) is configured. For monitoring only, it + contains the File System Changes event type. The only exception is that the Success filter cannot + be modified. + + - **Required:** Configure the File System Paths filter for Paths and Path Collections. This + analytic requires that you specify at least one path for file system location monitoring. + Multiple paths and/or collections can be included and excluded, along with the option to + monitor sub-folders. + + :::tip + Remember, if no path is provided, an error message displays when the analytic policy is + enabled: The “File System Analytic” policy must have at least one path to monitor defined. + ::: + + + - _Optional:_ Scope the operations being monitored on the File System filter. The default is to + monitor Write and Rename operations. + + :::info + Do not scope to include Read operations due to the quantity of files read + within an organization. + ::: + + + - _Optional:_ Scope the monitoring Agents to use for monitoring on the Additional Agents filter. + - _Optional:_ Scope the accounts to include in or exclude from being monitored on the AD + Perpetrator filter. + +- Actions tab – Configured the same way a regular policy’s + [Actions Tab](/docs/threatprevention/8.1/admin/policies/configuration/actions/overview.md) is configured. The only exceptions are that the + “Send to Event DB” and “Email Notifications” options are disabled. The event data collected by + analytic policies are stored in memory until an incident is triggered. For the “Send Raw Data to + SIEM” option, use _caution_, as this will send all event data not the triggered incident, which + could be a large volume of data. To send notifications on incidents, use the + [System Alerting Window](/docs/threatprevention/8.1/admin/configuration/systemalerting/overview.md) to configure Email and SIEM + alerts. + +**Policy Tab for Monitoring & Lockdown** + +![File System Attacks (by User) Analytic Type - Policy tab for Monitoring and Lockdown](/images/threatprevention/8.1/admin/analytics/policytabfsmonitoringlockdown.webp) + +When the **Enable Automatic Lockdown** option is selected on the **Settings** tab, the **Policy** +tab > **Event Type** tab includes both the File System Lockdown Event Type and the File System +Changes Event Type. + +The **Policy** tab for configuring analytics consists of the following sub-tabs: + +- General tab – Configured the same way a regular policy’s [General Tab](/docs/threatprevention/8.1/admin/policies/configuration/general.md) is + configured. The only exception is that the Name and Description are hard coded, and cannot be + modified. The Tags field is disabled for analytics. +- Event Type tab – Configured the same way a regular policy’s + [Event Type Tab](/docs/threatprevention/8.1/admin/policies/configuration/eventtype/overview.md) is configured. It contains both the + [File System Lockdown Event Type](/docs/threatprevention/8.1/admin/policies/configuration/eventtype/filesystemlockdown.md) and the + [File System Changes Event Type](/docs/threatprevention/8.1/admin/policies/configuration/eventtype/filesystemchanges/filesystemchanges.md). The only exception + is that for the Lockdown Event Type, the File System filter is hard coded to mirror the + configuration of the File System Changes Event Type settings. + + - _Optional:_ Scope the monitoring Agents to use for monitoring on the Additional Agents filter. + - The AD Perpetrator filter for Lockdown will auto-populate with perpetrators of the triggering + events. The list is hard coded to be a ‘blocking’ list, not an ‘allow’ list. + + - _Optional:_ Scope the accounts to block additional perpetrators. + - _Optional:_ Remove accounts that are being blocked from the list. + + :::note + Perpetrators manually removed from the list may be automatically re-added if + they trigger another incident + ::: + + +- Actions tab – Configured the same way a regular policy’s + [Actions Tab](/docs/threatprevention/8.1/admin/policies/configuration/actions/overview.md) is configured. The only exceptions are that the + “Send to Event DB” and “Email Notifications” options are disabled. The event data collected by + analytic policies are stored in memory until an incident is triggered. For the “Send Raw Data to + SIEM” option, use _caution_, as this will send all event data not the triggered incident, which + could be a large volume of data. To send notifications on incidents, use the + [System Alerting Window](/docs/threatprevention/8.1/admin/configuration/systemalerting/overview.md) to configure Email and SIEM + alerts. + +## File System Attacks (by User) Analytic Data Grid + +The data grid on the **File System Attacks (by user)** node lists one row per incident identified. + +![File System Attacks (by User) Analytic Type window](/images/threatprevention/8.1/admin/analytics/fsattacks.webp) + +The data grid can be filtered according to the Event Tracker status: All, New, or Reviewed. See the +[Event Tracker Window](/docs/threatprevention/8.1/admin/policies/configuration/recentevents/eventtracker.md) topic for additional information. + +The top data grid includes the following information for each incident: + +- Attacking Account Name – Security principal of the account that triggered the incident + + :::note + The name will be red if the attacking account is the Administrator account. + ::: + + +- Attacking Account SID – Security Identifier of the account used in the event +- First Attempt – Date timestamp of the first monitored event Hover over the data in this column to + view the local time (of the Enterprise Manager) and UTC time simultaneously. +- Last Attempt – Date timestamp of the last event that triggered the incident Hover over the data in + this column to view the local time (of the Enterprise Manager) and UTC time simultaneously.. +- Number of Files – Number of affected files monitored, sum of both the events which triggered the + incident and the events that have occurred before the incident closes +- Number of Events – Number of events monitored, sum of both the events which triggered the incident + and the events that have occurred before the incident closes +- Attacked Host Count – Number of hosts accessed during the specified interval matching this rule , + sum of both the events that triggered the incident and the events that have occurred before the + incident closes +- Attacked Share Count – Number of affected shares monitored, sum of both the events which triggered + the incident and the events that have occurred before the incident closes +- Primary Attacked Host – Name of the target host with the highest number of events at the time the + incident was triggered. It does not update after the incident is triggered. +- Primary Attacked Share – Name of the affected share on the primary attacked host with the highest + number of events at the time the incident was triggered. It does not update after the incident is + triggered. +- Primary Attacked Folder – Name of the affected folder on the primary attacked share with the + highest number of events at the time the incident was triggered. It does not update after the + incident is triggered. + +Select an incident in the top data grid to view information on the events that triggered the : + +- Agent: Domain – Active Directory domain where the Agent that monitored/blocked the event is + deployed +- Affected Object: Host – Name of the host the security principal is trying to access +- Affected Object: IP Address – IP address of the host where the affected object resides +- Affected Object: Class – Active Directory class of the affected object and indicates if the event + occurred against a file or folder +- Affected Object: Path – Original path of the affected file or folder +- Affected Object: New Path – New path of the affected file or folder +- Event: Name – Type of event monitored/blocked. The event name will be red if the event was blocked + by the auto-blocking feature. +- Perpetrator: Process Name – Identifies remotely accessed objects with “system” or the name of + process for locally accessed objects +- Perpetrator: Host – Name of the originating host +- Perpetrator: IP Address – IP address of the originating host. It will be blank if the affected + host has an operating system older than Windows Server 2008 R2. +- Perpetrator: Protocol – Name of the share where the operation was monitored/blocked. It will be + blank if the affected host has an operating system older than Windows Server 2008 R2. +- Date/Time – Date timestamp of the monitored event. Hover over the data in this column to view the + local time (of the Enterprise Manager) and UTC time simultaneously. +- Agent Time Logged – Timestamp for when the Agent detected the event. This can be different from + the Enterprise Manager time (displayed in the Date/Time column) due to latency. + +This data grid employs features for sorting, filtering, searching, and more. See the +[ Data Grid Functionality](/docs/threatprevention/8.1/admin/navigation/datagrid.md) topic for additional information. diff --git a/docs/threatprevention/8.1/admin/analytics/forgedpac.md b/docs/threatprevention/8.1/admin/analytics/forgedpac.md new file mode 100644 index 0000000000..a1a6388fc9 --- /dev/null +++ b/docs/threatprevention/8.1/admin/analytics/forgedpac.md @@ -0,0 +1,140 @@ +--- +title: "Forged PAC" +description: "Forged PAC Analytic Type" +sidebar_position: 70 +--- + +# Forged PAC Analytic Type + +The **Forged Privilege Account Certificate** (PAC) analytic type identifies Kerberos tickets with a +modified PAC. By manipulating the PAC, a field in the Kerberos ticket that contains a user’s +authorization data (in Active Directory, this is group membership), an attacker is able to grant +themselves elevated privileges. + +| Forged PAC | | +| -------------------- | ----------------------------- | +| Definition | Kerberos tickets with modified Privilege Account Certificate (PAC) | +| Example | Kerberos tickets are used as a sort of “pass card” to obtain access to resources. Once a domain controller authenticates a user, a TGT (ticket granting ticket) is granted with a limited lifespan. This is then used to obtain TGS (ticket granting service) and the TGS is what identifies a user to a resource on the network. A known vulnerability exists where PAC part of a ticket can be modified to include groups the user is not a member of. If a user on the network were to attempt to use such a ticket, this analytic would detect the altered ticket and generate an alert. | +| Trigger | PAC of the ticket contains RIDs that are not TokenGroups attribute. | +| Recommended Settings | No additional configuration needed | + +**Analytic Workflow** + +1. Configure the analytic policy +2. Enable the analytic policy +3. Enable alerting on incidents through the + [System Alerting Window](/docs/threatprevention/8.1/admin/configuration/systemalerting/overview.md). + +See the Forged PAC Analytic Data Grid topic for information on event data collected per incident. + +## Configure Forged PAC Analytic Policy + +Open the Forged PAC Analytic Policy in any of the following ways: + +- Click Analytics in the left pane to launch the Analytics interface. Then click the gear icon for + the analytic. +- Expand the Analytics node and click the desired analytic. On the analytic window, click the gear + icon available in the top right corner. + +The Configure Analytics window has two tabs: + +- Settings – Where the analytic trigger is defined +- Policy – Where filters can be added, additional actions configured, a custom schedule set, and the + policy enabled + +**Settings Tab** + +![Forged PAC Analytic Type - Settings tab](/images/threatprevention/8.1/admin/analytics/forgedpacsettings.webp) + +Remember, the Forged PAC analytic is monitoring for when the user is not a member of a group that is +listed in the PAC section of the user’s Kerberos ticket. This analytic can be scoped to monitor +specific groups. To reduce the number of false positives, Threat Prevention only checks for a +mismatch of sensitive groups you specify on the Settings tab. + +You can select specific RIDs that Threat Prevention compares against the PAC and user’s access token +for a mismatch to trigger the incident. + +- Click the **Add** (**+**) button to open the + [Select AD Groups Window](/docs/threatprevention/8.1/admin/policies/configuration/eventtype/window/groups.md), where you + can select the desired Active Directory group(s). On selection, the RID of that group is monitored + for modifications. +- The **Remove** (**x**) button removes the selected item(s) from the incident criteria. + +**Policy Tab** + +![Forged PAC Analytic Type - Policy tab](/images/threatprevention/8.1/admin/analytics/policytab.webp) + +The **Policy** tab for configuring analytics consists of three sub-tabs: + +- General tab – Configured the same way a regular policy’s [General Tab](/docs/threatprevention/8.1/admin/policies/configuration/general.md) is + configured. The only exception is that the Name and Description are hard coded, and cannot be + modified. The Tags field is disabled for analytics. +- Event Type tab – Configured the same way a regular policy’s + [Event Type Tab](/docs/threatprevention/8.1/admin/policies/configuration/eventtype/overview.md) is configured. The only exception is that the + [Authentication Monitoring Event Type](/docs/threatprevention/8.1/admin/policies/configuration/eventtype/authenticationmonitoring.md) is hard + coded, and the Success filter cannot be modified. + + - Scope the servers to be included in or excluded from monitoring on the IP Addresses (from) + filter, the IP Addresses (to) filter, the Hosts (from) filter, or the Hosts (to) filter. + + :::note + Some authentication events may return only a host name (NetBIOS or FQDN), others + may return only an IP address. It is recommended to take this into account when entering + filter values. + ::: + + + - _Alternatively:_ Scope the domains to be included in or excluded from monitoring on the + Domains/Servers filter. + - _Optional:_ Scope the protocol to be monitored on the Authentication Protocol filter. If + enabling the analytic on a domain controller, also scope the login type. The Authentication + Protocol filter is hard coded to ensure the Kerberos protocol is monitored. + + :::note + The Exclude failed authentications with ‘N-2’ passwords option requires a GPO + within the organization be configured to ‘Enforce password history’ with a setting of a + minimum of ‘3 passwords remembered’ or it will not have an effect. + ::: + + + - _Optional:_ Scope the accounts to include in or exclude from being monitored on the AD + Perpetrator filter. + +- Actions tab – Configured the same way a regular policy’s + [Actions Tab](/docs/threatprevention/8.1/admin/policies/configuration/actions/overview.md) is configured. The only exceptions are that the + “Send to Event DB” and “Email Notifications” options are disabled. The event data collected by + analytic policies are stored in memory until an incident is triggered. For the “Send Raw Data to + SIEM” option, use _caution_, as this will send all event data not the triggered incident, which + could be a large volume of data. To send notifications on incidents, use the + [System Alerting Window](/docs/threatprevention/8.1/admin/configuration/systemalerting/overview.md) to configure Email and SIEM + alerts. + +## Forged PAC Analytic Data Grid + +The data grid on the **Forged PAC** node lists one row per incident identified. + +![Forged PAC Analytic Type window](/images/threatprevention/8.1/admin/analytics/forgedpac.webp) + +The data grid can be filtered according to the Event Tracker status: All, New, or Reviewed. See the +[Event Tracker Window](/docs/threatprevention/8.1/admin/policies/configuration/recentevents/eventtracker.md) topic for additional information. + +The top data grid includes the following information for each incident: + +- From Host – Name of the originating host +- From Host IP Address – IP address of the originating host +- To Host – Name of the target host +- To Host IP Address –IP address of the target host +- Account Name – Security principal of the account that triggered the incident +- Account SID – Security Identifier of the account used in the event that triggered the incident +- Access Type – Type of authentication with encryption, e.g. TGS: cifs/ enc:23/18, TGS: krbtgt/ enc: + 23/18, etc. +- Status – Indication of whether the authentication was successful +- Date/Time – Date timestamp of the monitored event. Hover over the data in this column to view the + local time (of the Enterprise Manager) and UTC time simultaneously. +- Detected on DC – Fully-qualified name of the domain controller that detected the event +- PAC Delta – RID for the group that does not have access +- Agent Time Logged – Timestamp for when the Agent detected the event. This can be different from + the Enterprise Manager time (displayed in the Date/Time column) due to latency. + +This data grid employs features for sorting, filtering, searching, and more. See the +[ Data Grid Functionality](/docs/threatprevention/8.1/admin/navigation/datagrid.md) topic for additional information. diff --git a/docs/threatprevention/8.1/admin/analytics/goldenticket.md b/docs/threatprevention/8.1/admin/analytics/goldenticket.md new file mode 100644 index 0000000000..86bc5f34f5 --- /dev/null +++ b/docs/threatprevention/8.1/admin/analytics/goldenticket.md @@ -0,0 +1,142 @@ +--- +title: "Golden Ticket" +description: "Golden Ticket Analytic Type" +sidebar_position: 80 +--- + +# Golden Ticket Analytic Type + +The **Golden Tickets** analytic type identifies Kerberos tickets that exceed the specified maximum +lifetimes for a user ticket or maximum lifetimes for a user ticket renewal. Every time an account +authenticates, the ticket is checked against the maximum ticket lifetime and maximum renewals +configured within this analytic type. Any ticket that exceeds either ‘maximum’ will trigger an +incident. + +| Golden Tickets | | +| -------------------- | ------------------------------ | +| Definition | Kerberos tickets with modified maximum lifetimes for a user ticket and maximum lifetimes for a user ticket renewal | +| Example | Kerberos tickets are used as a sort of “pass card” to obtain access to resources. Once a domain controller authenticates a user, a TGT (ticket granting ticket) is granted with a limited lifespan. This is then used to obtain TGS (ticket granting service) and the TGS is what identifies a user to a resource on the network.
On TGT expiry, the user account is checked for validity (password, enabled/disabled, group memberships, etc.) and a new TGT is granted. A known vulnerability exists where a domain admin could forge the TGT renewal time, creating an indefinite “golden” ticket. This could be accomplished, and then the underlying account removed, allowing the user to obtain admin access forever with an account that no longer exists. If a user on the network were to attempt to use such a ticket, this analytic would detect the altered ticket and generate an alert. | +| Trigger | Maximum lifetime for a user ticket > than X hours
OR
Maximum lifetime for a user ticket renewal > Y days | +| Recommended Settings | Netwrix recommends configuring this analytic to trigger a hit if the maximum lifetime for a user ticket is greater than 24 hours or the maximum lifetime for a user ticket renewal is greater than 30 days. | + +**Analytic Workflow** + +1. Configure the analytic policy +2. Enable the analytic policy +3. Enable alerting on incidents through the + [System Alerting Window](/docs/threatprevention/8.1/admin/configuration/systemalerting/overview.md). + +See the Golden Tickets Analytic Data Grid topic for information on event data collected per +incident. + +## Configure Golden Tickets Analytic Policy + +Open the Golden Tickets Analytic Policy in any of the following ways: + +- Click Analytics in the left pane to launch the Analytics interface. Then click the gear icon for + the analytic. +- Expand the Analytics node and click the desired analytic. On the analytic window, click the gear + icon available in the top right corner. + +The Configure Analytics window has two tabs: + +- Settings – Where the analytic trigger is defined +- Policy – Where filters can be added, additional actions configured, a custom schedule set, and the + policy enabled + +**Settings Tab** + +![Golden Ticket Analytic Type - Settings tab](/images/threatprevention/8.1/admin/analytics/goldenticketsettings.webp) + +Set the _Maximum Lifetime for User Ticket [value] Hours_ and the _Maximum Lifetime for User Ticket +Renewal [value] Days_ to trigger the incident. The default Microsoft Windows lifetime for user +tickets is ten hours, and the renewal period is seven days. This analytic policy will check each +ticket that requests authentication against the values set in this analytic policy. Any time a +ticket exceeds either of these values, an incident is triggered. + +**Policy Tab** + +![Golden Ticket Analytic Type - Policy tab](/images/threatprevention/8.1/admin/analytics/policytab.webp) + +The **Policy** tab for configuring analytics consists of three sub-tabs: + +- General tab – Configured the same way a regular policy’s [General Tab](/docs/threatprevention/8.1/admin/policies/configuration/general.md) is + configured. The only exception is that the Name and Description are hard coded, and cannot be + modified. The Tags field is disabled for analytics. +- Event Type tab – Configured the same way a regular policy’s + [Event Type Tab](/docs/threatprevention/8.1/admin/policies/configuration/eventtype/overview.md) is configured. The only exception is that the + [Authentication Monitoring Event Type](/docs/threatprevention/8.1/admin/policies/configuration/eventtype/authenticationmonitoring.md) is hard + coded, and the Success filter cannot be modified. + + :::info + Do not configure any filters for this analytic type. + ::: + + + - _Optional:_ Scope the protocol to be monitored on the Authentication Protocol filter. If + enabling the analytic on a domain controller, also scope the login type. + + :::note + The Exclude failed authentications with ‘N-2’ passwords option requires a GPO + within the organization be configured to ‘Enforce password history’ with a setting of a + minimum of ‘3 passwords remembered’ or it will not have an effect. + ::: + + + - \_Optional:\_Scope the domains to be included in or excluded from monitoring on the + Domains/Servers filter. + - \_Optional:\_Scope the accounts to include in or exclude from being monitored on the AD + Perpetrator filter. + - \_Optional:\_Scope the servers to be included in or excluded from monitoring on the IP + Addresses (from) filter, the IP Addresses (to) filter, the Hosts (from) filter, or the Hosts + (to) filter. + + :::note + Some authentication events may return only a host name (NetBIOS or FQDN), others + may return only an IP address. It is recommended to take this into account when entering + filter values. + ::: + + +- Actions tab – Configured the same way a regular policy’s + [Actions Tab](/docs/threatprevention/8.1/admin/policies/configuration/actions/overview.md) is configured. The only exceptions are that the + “Send to Event DB” and “Email Notifications” options are disabled. The event data collected by + analytic policies are stored in memory until an incident is triggered. For the “Send Raw Data to + SIEM” option, use _caution_, as this will send all event data not the triggered incident, which + could be a large volume of data. To send notifications on incidents, use the + [System Alerting Window](/docs/threatprevention/8.1/admin/configuration/systemalerting/overview.md) to configure Email and SIEM + alerts. + +## Golden Tickets Analytic Data Grid + +The data grid on the **Golden Tickets** node lists one row per incident identified. + +![Golden Ticket Analytic Type window](/images/threatprevention/8.1/admin/analytics/goldenticket.webp) + +The data grid can be filtered according to the Event Tracker status: All, New, or Reviewed. See the +[Event Tracker Window](/docs/threatprevention/8.1/admin/policies/configuration/recentevents/eventtracker.md) topic for additional information. + +The top data grid includes the following information for each incident: + +- From Host – Name of the originating host +- From Host IP Address – IP address of the originating host +- To Host – Name of the target host +- To Host IP Address – IP address of the target host +- Account Name – Security principal of the account that triggered the incident +- Account SID – Security Identifier of the account used in the event that triggered the incident +- Access Type – Type of authentication, e.g. RDP, CIFS, etc. +- Status – Indication of whether the authentication was successful +- Date/Time – Date timestamp of the monitored event. Hover over the data in this column to view the + local time (of the Enterprise Manager) and UTC time simultaneously. +- Detected on DC – Fully-qualified name of the domain controller that detected the event +- TGT StartTime – Date timestamp for the start time of the ticket; the specified time is the local + time for the server where the Agent is deployed +- TGT EndTime – Date timestamp for the expiration time of the ticket; the specified time is the + local time for the server where the Agent is deployed +- TGT MaxRenew – Date timestamp for the maximum renewal date of the ticket; the specified time is + the local time for the server where the Agent is deployed +- Agent Time Logged – Timestamp for when the Agent detected the event. This can be different from + the Enterprise Manager time (displayed in the Date/Time column) due to latency. + +This data grid employs features for sorting, filtering, searching, and more. See the +[ Data Grid Functionality](/docs/threatprevention/8.1/admin/navigation/datagrid.md) topic for additional information. diff --git a/docs/threatprevention/8.1/admin/analytics/horizontalmovementattacks.md b/docs/threatprevention/8.1/admin/analytics/horizontalmovementattacks.md new file mode 100644 index 0000000000..2c1727afde --- /dev/null +++ b/docs/threatprevention/8.1/admin/analytics/horizontalmovementattacks.md @@ -0,0 +1,160 @@ +--- +title: "Horizontal Movement Attacks" +description: "Horizontal Movement Attacks Analytic Type" +sidebar_position: 90 +--- + +# Horizontal Movement Attacks Analytic Type + +The **Horizontal Movement Attacks** analytic type identifies security principals that are accessing +more than the threshold of resources during the specified time interval. + +:::info +Configure a subset of accounts and/or servers to be monitored in order to avoid +the excessive volume of event activity from monitoring all. +::: + + +| Horizontal Movement Attacks | | +| --------------------------- | ------------------------------- | +| Definition | User account authentications across multiple network assets in a specified time period | +| Example | Malware uses several techniques to spread its payload during the initial phase of an attack including Pass the Hash, Impersonation, and current session logged on credentials. Regardless of the method, authentication takes place against other targets on the network, triggering a Threat Prevention horizontal movement alert. | +| Trigger | Successful or failed authentications of a given account across X number of resources in Y minutes | +| Recommended Settings | Configure this analytic to trigger a hit if Threat Prevention monitors successful or failed authentications of a given account across 10 resources in 3 minutes. | + +**Analytic Workflow** + +1. Configure the analytic policy +2. Enable the analytic policy +3. Enable alerting on incidents through the + [System Alerting Window](/docs/threatprevention/8.1/admin/configuration/systemalerting/overview.md). + +See the Horizontal Movement Attacks Analytic Data Grid topic for information on event data collected +per incident. + +## Configure Horizontal Movement Attacks Analytic Policy + +Open the Horizontal Movement Attacks Analytic Policy in any of the following ways: + +- Click Analytics in the left pane to launch the Analytics interface. Then click the gear icon for + the analytic. +- Expand the Analytics node and click the desired analytic. On the analytic window, click the gear + icon available in the top right corner. + +The Configure Analytics window has two tabs: + +- Settings – Where the analytic trigger is defined +- Policy – Where filters can be added, additional actions configured, a custom schedule set, and the + policy enabled + +**Settings Tab** + +![Horizontal Movement Attacks Analytic Type - Settings tab](/images/threatprevention/8.1/admin/analytics/horizontalattackssettings.webp) + +Set the Number of Hosts and the Interval Duration to trigger the incident. The interval duration is +set for (hours:minutes) and is capped at 23:59. When successful or failed authentications of a given +account occurs across the specified number of hosts within the specified interval duration, it will +trigger an incident record. + +By default, authentication event data is cached in memory for 24 hours. When an incident is +triggered, an incident record is saved to the database along with the events that triggered the +incident. Raw authentication event data that did not contribute to an incident are purged from +memory once they are more than 24 hours old. + +If checked, the Ignore failed logins for unresolved user names option will exclude bad user IDs from +contributing to Horizontal Movement Attacks incidents. + +**Policy Tab** + +![Horizontal Movement Attacks Analytic Type - Policy tab](/images/threatprevention/8.1/admin/analytics/policytab.webp) + +The **Policy** tab for configuring analytics consists of three sub-tabs: + +- General tab – Configured the same way a regular policy’s [General Tab](/docs/threatprevention/8.1/admin/policies/configuration/general.md) is + configured. The only exception is that the Name and Description are hard coded, and cannot be + modified. The Tags field is disabled for analytics. +- Event Type tab – Configured the same way a regular policy’s + [Event Type Tab](/docs/threatprevention/8.1/admin/policies/configuration/eventtype/overview.md) is configured. The only exception is that the + [Authentication Monitoring Event Type](/docs/threatprevention/8.1/admin/policies/configuration/eventtype/authenticationmonitoring.md) is hard + coded, and the Success filter cannot be modified. + + - Scope the accounts to include in or exclude from being monitored on the AD Perpetrator filter. + - \_Optional:\_Scope the protocol to be monitored on the Authentication Protocol filter. If + enabling the analytic on a domain controller, also scope the login type. + + :::note + The Exclude failed authentications with ‘N-2’ passwords option requires a GPO + within the organization be configured to ‘Enforce password history’ with a setting of a + minimum of ‘3 passwords remembered’ or it will not have an effect. + ::: + + + - \_Optional:\_Scope the domains to be included in or excluded from monitoring on the + Domains/Servers filter. + - _Optional:_ Scope the servers to be included in or excluded from monitoring on the IP + Addresses (from) filter, the IP Addresses (to) filter, the Hosts (from) filter, or the Hosts + (to) filter. + + :::note + Some authentication events may return only a host name (NetBIOS or FQDN), others + may return only an IP address. It is recommended to take this into account when entering + filter values. + ::: + + +- Actions tab – Configured the same way a regular policy’s + [Actions Tab](/docs/threatprevention/8.1/admin/policies/configuration/actions/overview.md) is configured. The only exceptions are that the + “Send to Event DB” and “Email Notifications” options are disabled. The event data collected by + analytic policies are stored in memory until an incident is triggered. For the “Send Raw Data to + SIEM” option, use _caution_, as this will send all event data not the triggered incident, which + could be a large volume of data. To send notifications on incidents, use the + [System Alerting Window](/docs/threatprevention/8.1/admin/configuration/systemalerting/overview.md) to configure Email and SIEM + alerts. + +## Horizontal Movement Attacks Analytic Data Grid + +The data grid on the **Horizontal Movement Attacks** node lists one row per incident identified. + +![Horizontal Movement Attacks Analytic Type window](/images/threatprevention/8.1/admin/analytics/horizontalmovement.webp) + +The data grid can be filtered according to the Event Tracker status: All, New, or Reviewed. See the +[Event Tracker Window](/docs/threatprevention/8.1/admin/policies/configuration/recentevents/eventtracker.md) topic for additional information. + +The top data grid includes the following information for each incident: + +- Attacking Account Name – Security principal of the account that triggered the incident + + :::note + The name will be red if the attacking account is the Administrator account. + ::: + + +- Attacking Account SID – Security Identifier of the account used in the event +- First Attempt – Date timestamp of the first monitored event that triggered the incident. Hover + over the data in this column to view the local time (of the Enterprise Manager) and UTC time + simultaneously. +- Last Attempt – Date timestamp of the last event that triggered the incident. Hover over the data + in this column to view the local time (of the Enterprise Manager) and UTC time simultaneously. +- Protocol – Protocol(s) used for the monitored operation +- Number of Attempts – Number of attempts monitored during the specified interval matching this rule +- Number of Hosts – Number of hosts accessed during the specified interval matching this rule + +Select an incident in the top data grid to view information on the events that triggered the +incident: + +- From Host – Name of the originating host +- From Host IP Address – IP address of the originating host +- To Host – Name of the target host +- To Host IP Address – IP address of the target host +- Protocol – Protocol(s) used for the monitored operation +- Access Type – Type of authentication, e.g. RDP, CIFS, etc. +- Status – Detailed information on the error generated by the event +- Detected on DC – Fully-qualified name of the domain controller that detected the event +- Events Count – Number of identical events that occurred in one minute +- Date/Time – Date timestamp of the monitored event. Hover over the data in this column to view the + local time (of the Enterprise Manager) and UTC time simultaneously. +- Agent Time Logged – Timestamp for when the Agent detected the event. This can be different from + the Enterprise Manager time (displayed in the Date/Time column) due to latency. + +This data grid employs features for sorting, filtering, searching, and more. See the +[ Data Grid Functionality](/docs/threatprevention/8.1/admin/navigation/datagrid.md) topic for additional information. diff --git a/docs/threatprevention/8.1/admin/analytics/impersonationlogins.md b/docs/threatprevention/8.1/admin/analytics/impersonationlogins.md new file mode 100644 index 0000000000..e1f7b2ff95 --- /dev/null +++ b/docs/threatprevention/8.1/admin/analytics/impersonationlogins.md @@ -0,0 +1,155 @@ +--- +title: "Impersonation Logins" +description: "Impersonation Logins Analytic Type" +sidebar_position: 100 +--- + +# Impersonation Logins Analytic Type + +The **Impersonation Logins** analytic type identifies multiple authenticated accounts from a single +system within the specified time frame. + +:::info +Configure a subset of accounts and/or servers to be monitored in order to avoid +the excessive volume of event activity from monitoring all. +::: + + +| Impersonation Logins | | +| -------------------- | --------------------------- | +| Definition | Multiple authenticated accounts from a single system | +| Example | A perpetrator may wish to mask their activities by authenticating using alternate credentials. While logged in using their primary user ID, the perpetrator will authenticate against a network resource using an alternate ID; this is known as impersonation. Impersonation is often used by administrators, but not normally used by end-users. An attacker will often use impersonation to obtain increased rights to remote systems. This analytic identifies hosts that are using impersonated authentications. | +| Trigger | X different authenticated accounts from a single system in Y hours | +| Recommended Settings | Netwrix recommends configuring this analytic to trigger a hit if Threat Prevention monitors 3 different authenticated accounts from a single system in 2 hours. | + +**Analytic Workflow** + +1. Configure the analytic policy +2. Enable the analytic policy +3. Enable alerting on incidents through the + [System Alerting Window](/docs/threatprevention/8.1/admin/configuration/systemalerting/overview.md). + +See the Impersonation Logins Analytic Data Grid topic for information on event data collected per +incident. + +## Configure Impersonation Logins Analytic Policy + +Open the Impersonation Logins Analytic Policy in any of the following ways: + +- Click Analytics in the left pane to launch the Analytics interface. Then click the gear icon for + the analytic. +- Expand the Analytics node and click the desired analytic. On the analytic window, click the gear + icon available in the top right corner. + +The Configure Analytics window has two tabs: + +- Settings – Where the analytic trigger is defined +- Policy – Where filters can be added, additional actions configured, a custom schedule set, and the + policy enabled + +**Settings Tab** + +![Impersonation Logins Analytic Type - Settings tab](/images/threatprevention/8.1/admin/analytics/concurrentloginssettings.webp) + +Set the Number of Accounts and the Interval Duration to trigger the incident. The interval duration +is set for (hours:minutes) and is capped at 23:59. When the specified number of account credentials +different from those used to log into the originating host have accessed services, applications, +remote connections, etc. within the specified interval duration, it will trigger an incident record. + +By default, authentication event data is cached in memory for 24 hours. When an incident is +triggered, an incident record is saved to the database along with the events that triggered the +incident. Raw authentication event data that did not contribute to an incident are purged from +memory once they are more than 24 hours old. + +**Policy Tab** + +![Impersonation Logins Analytic Type - Policy tab](/images/threatprevention/8.1/admin/analytics/policytab.webp) + +The **Policy** tab for configuring analytics consists of three sub-tabs: + +- General tab – Configured the same way a regular policy’s [General Tab](/docs/threatprevention/8.1/admin/policies/configuration/general.md) is + configured. The only exception is that the Name and Description are hard coded, and cannot be + modified. The Tags field is disabled for analytics. +- Event Type tab – Configured the same way a regular policy’s + [Event Type Tab](/docs/threatprevention/8.1/admin/policies/configuration/eventtype/overview.md) is configured. The only exception is that the + [Authentication Monitoring Event Type](/docs/threatprevention/8.1/admin/policies/configuration/eventtype/authenticationmonitoring.md) is hard + coded, and the Success filter cannot be modified. + + - _Optional:_ Scope the protocol to be monitored on the Authentication Protocol filter. If + enabling the analytic on a domain controller, also scope the login type. + + :::note + The Exclude failed authentications with ‘N-2’ passwords option requires a GPO + within the organization be configured to ‘Enforce password history’ with a setting of a + minimum of ‘3 passwords remembered’ or it will not have an effect. + ::: + + + - _Optional:_ – Scope the domains to be included in or excluded from monitoring on the + Domains/Servers filter. + - _Optional:_ – Scope the accounts to include in or exclude from being monitored on the AD + Perpetrator filter. + - _Optional:_ – Scope the servers to be included in or excluded from monitoring on the IP + Addresses (from) filter, the IP Addresses (to) filter, the Hosts (from) filter, or the Hosts + (to) filter. + + :::note + Some authentication events may return only a host name (NetBIOS or FQDN), others + may return only an IP address. It is recommended to take this into account when entering + filter values. + ::: + + +- Actions tab – Configured the same way a regular policy’s + [Actions Tab](/docs/threatprevention/8.1/admin/policies/configuration/actions/overview.md) is configured. The only exceptions are that the + “Send to Event DB” and “Email Notifications” options are disabled. The event data collected by + analytic policies are stored in memory until an incident is triggered. For the “Send Raw Data to + SIEM” option, use _caution_, as this will send all event data not the triggered incident, which + could be a large volume of data. To send notifications on incidents, use the + [System Alerting Window](/docs/threatprevention/8.1/admin/configuration/systemalerting/overview.md) to configure Email and SIEM + alerts. + +## Impersonation Logins Analytic Data Grid + +The data grid on the **Impersonation Logins** node lists one row per incident identified. + +![Impersonation Logins Analytic Type window](/images/threatprevention/8.1/admin/analytics/impersonationlogins.webp) + +The data grid can be filtered according to the Event Tracker status: All, New, or Reviewed. See the +[Event Tracker Window](/docs/threatprevention/8.1/admin/policies/configuration/recentevents/eventtracker.md) topic for additional information. + +The top data grid includes the following information for each incident: + +- Attacking Host – Name of the originating host from which a user account logged in +- Attacking Host IP Address – IP address of the originating host +- Number of Accounts – Number of unique accounts that logged in from this host +- Accounts – Security principal of the account that triggered the event for the attempted + impersonation. All accounts will be listed. +- First Attempt – Date timestamp of the first monitored event that triggered the incident. Hover + over the data in this column to view the local time (of the Enterprise Manager) and UTC time + simultaneously. +- Last Attempt – Date timestamp of the last event that triggered the incident. Hover over the data + in this column to view the local time (of the Enterprise Manager) and UTC time simultaneously. +- Protocols – Protocol(s) used for the monitored operation +- Number of Attempts – Number of attempts monitored during the specified interval matching this rule + +Select an incident in the top data grid to view information on the events that triggered the +incident: + +- Account Name – Security principal of the account that triggered the event for the attempted + impersonation +- Account SID – Security Identifier of the account used in the event for the attempted impersonation +- To Host – Name of the target host +- To Host IP Address – IP address of the target host +- Protocol – Protocol(s) used for the monitored operation +- Access Type – Type of authentication, e.g. RDP, CIFS, etc. +- Status – Detailed information on the error generated by the event +- Detected on DC – Fully-qualified name of the domain controller that detected the event +- Events Count – Number of identical events that occurred in one minute +- Date/Time – Date timestamp of the monitored event. Hover over data in this column to view Agent + time, Local time (of the Enterprise Manager), and UTC time simultaneously. +- Agent Time Logged – Timestamp for when the Agent detected the event. This can be different from + the Enterprise Manager time (displayed in the Date/Time column) due to latency. + +This data grid employs features for sorting, filtering, searching, and more. See the +[ Data Grid Functionality](/docs/threatprevention/8.1/admin/navigation/datagrid.md) topic for additional information. diff --git a/docs/threatprevention/8.1/admin/analytics/kerberosweakencryption.md b/docs/threatprevention/8.1/admin/analytics/kerberosweakencryption.md new file mode 100644 index 0000000000..1ccb040a92 --- /dev/null +++ b/docs/threatprevention/8.1/admin/analytics/kerberosweakencryption.md @@ -0,0 +1,122 @@ +--- +title: "Kerberos Weak Encryption" +description: "Kerberos Weak Encryption Analytic Type" +sidebar_position: 110 +--- + +# Kerberos Weak Encryption Analytic Type + +The **Kerberos Weak Encryption** analytic type identifies Kerberos tickets with RC4_HMAC_MD5 +encryption by detecting the use of weak encryption. Various attack methods utilize weak Kerberos +encryption cyphers, including Overpass-the-Hash. + +| Kerberos Weak Encryption | | +| ------------------------ | ---------------------------- | +| Definition | Kerberos tickets with RC4_HMAC_MD5 encryption. | +| Example | Kerberos tickets are used as a sort of “pass card” to obtain access to resources. Once a domain controller authenticates a user, a TGT (ticket granting ticket) is granted with a limited lifespan. This is then used to obtain TGS (ticket granting service) and the TGS is what identifies a user to a resource on the network.
If RC4_HMAC_MD5 encryption is used then it makes possible to obtain password value using Kerberoasting attack. If a user on the network were to attempt to use such a ticket, this analytic would detect this ticket and generate an alert. | +| Trigger | Ticket uses RC4_HMAC_MD5 encryption. | +| Recommended Settings | No additional configuration is needed | + +**Analytic Workflow** + +1. Configure the analytic policy +2. Enable the analytic policy +3. Enable alerting on incidents through the + [System Alerting Window](/docs/threatprevention/8.1/admin/configuration/systemalerting/overview.md). + +See the Kerberos Weak Encryption Analytic Data Grid topic for information on event data collected +per incident. + +## Configure Kerberos Weak Encryption Analytic Policy + +Open the Kerberos Weak Encryption Policy in any of the following ways: + +- Click Analytics in the left pane to launch the Analytics interface. Then click the gear icon for + the analytic. +- Expand the Analytics node and click the desired analytic. On the analytic window, click the gear + icon available in the top right corner. + +The Configure Analytics window has one tab: + +- Policy – Where filters can be added, additional actions configured, a custom schedule set, and the + policy enabled + +**Policy Tab** + +![Kerberos Weak Encryption Analytic Type - Policy tab](/images/threatprevention/8.1/admin/analytics/policytab.webp) + +The **Policy** tab for configuring analytics consists of three sub-tabs: + +- General tab – Configured the same way a regular policy’s [General Tab](/docs/threatprevention/8.1/admin/policies/configuration/general.md) is + configured. The only exception is that the Name and Description are hard coded, and cannot be + modified. The Tags field is disabled for analytics. +- Event Type tab – Configured the same way a regular policy’s + [Event Type Tab](/docs/threatprevention/8.1/admin/policies/configuration/eventtype/overview.md) is configured. The only exception is that the + [Authentication Monitoring Event Type](/docs/threatprevention/8.1/admin/policies/configuration/eventtype/authenticationmonitoring.md) is hard + coded, and the Success filter cannot be modified. + + - Scope the servers to be included in or excluded from monitoring on the IP Addresses (from) + filter, the IP Addresses (to) filter, the Hosts (from) filter, or the Hosts (to) filter. + + :::note + Some authentication events may return only a host name (NetBIOS or FQDN), others + may return only an IP address. It is recommended to take this into account when entering + filter values. + ::: + + + - *Alternatively:* Scope the domains to be included in or excluded from monitoring on the + Domains/Servers filter. + - \_Optional:\_Scope the protocol to be monitored on the Authentication Protocol filter. If + enabling the analytic on a domain controller, also scope the login type. The Authentication + Protocol filter is hard coded to ensure the Kerberos protocol is monitored. + + :::note + The Exclude failed authentications with ‘N-2’ passwords option requires a GPO + within the organization be configured to ‘Enforce password history’ with a setting of a + minimum of ‘3 passwords remembered’ or it will not have an effect. + ::: + + + - _Optional_ – Scope the accounts to include in or exclude from being monitored on the AD + Perpetrator filter. + +- Actions tab – Configured the same way a regular policy’s + [Actions Tab](/docs/threatprevention/8.1/admin/policies/configuration/actions/overview.md) is configured. The only exceptions are that the + “Send to Event DB” and “Email Notifications” options are disabled. The event data collected by + analytic policies are stored in memory until an incident is triggered. For the “Send Raw Data to + SIEM” option, use _caution_, as this will send all event data not the triggered incident, which + could be a large volume of data. To send notifications on incidents, use the + [System Alerting Window](/docs/threatprevention/8.1/admin/configuration/systemalerting/overview.md) to configure Email and SIEM + alerts. + +## Kerberos Weak Encryption Analytic Data Grid + +The data grid on the **Kerberos Weak Encryption** node lists one row per incident identified. + +![kerberosweakencryption](/images/threatprevention/8.1/admin/analytics/kerberosweakencryption.webp) + +The data grid can be filtered according to the Event Tracker status: All, New, or Reviewed. See the +[Event Tracker Window](/docs/threatprevention/8.1/admin/policies/configuration/recentevents/eventtracker.md) topic for additional information. + +The top data grid includes the following information for each incident: + +- From Host – Name of the originating host +- From Host IP Address – IP address of the originating host +- To Host – Name of the target host +- To Host IP Address – IP address of the target host +- Account Name – Security principal of the account that triggered the incident +- Account SID – Security Identifier of the account used in the event +- Access Type – Type of authentication with encryption, e.g. TGS: cifs/ enc:23/18, TGS: krbtgt/ enc: + 23/18, etc. +- SPN – The service principal name (SPN) included in the Kerberos ticket data +- Status – Indication of whether the authentication was successful +- Date/Time – Date timestamp of the monitored event. Hover over the data in this column to view the + local time (of the Enterprise Manager) and UTC time simultaneously. +- Detected on DC – Fully-qualified name of the domain controller that detected the event +- Encryption Type – Type of encryption identified as weak that triggered the incident +- Agent Time Logged – Timestamp for when the Agent detected the event. This can be different from + the Enterprise Manager time (displayed in the Date/Time column) due to latency. + +This data grid employs features for sorting, filtering, searching, and more. See the +[ Data Grid Functionality](/docs/threatprevention/8.1/admin/navigation/datagrid.md) topic for additional information. diff --git a/docs/threatprevention/8.1/admin/analytics/overview.md b/docs/threatprevention/8.1/admin/analytics/overview.md new file mode 100644 index 0000000000..d80719b34b --- /dev/null +++ b/docs/threatprevention/8.1/admin/analytics/overview.md @@ -0,0 +1,89 @@ +--- +title: "Analytics Interface" +description: "Analytics Interface" +sidebar_position: 70 +--- + +# Analytics Interface + +Analytics provide organizations with the ability to capture and analyze authentication traffic +occurring within their Active Directory environments in real-time to detect patterns of behavior and +scenarios relating to attacks and attempts to compromise security. + +An Analytic is basically a hard-coded policy. Instead of reporting on individual events, it reports +on incidents that are triggered by those events. + +Once an Analytic is configured and enabled, the Agent begins monitoring for events. Each event is +stored in the Agent memory until the trigger threshold is met. Then an incident is logged in the +database along with the event details that triggered the incident. Events that do not trigger an +incident are discarded from memory after the corresponding time range. + +The tables below outline the authentication analytics Threat Prevention provides out-of-the box, +along with definitions and examples to better understand each analytic. + +Click **Analytics** in the left pane to launch the Analytics interface. + +![Analytics interface](/images/threatprevention/8.1/admin/analytics/analyticsinterface.webp) + +At the top of the interface is a graphical display of incidents monitored by Threat Prevention. Use +the color key on the left to toggle off and on results for desired analytics. In the upper-right +corner, set the number of days’ worth of incidents the graphs display. Use the Refresh button in the +graphics area to regenerate the graphs. + +There are two graphs: + +- Pie graph – Shows the percentage of incidents generated for each analytic type +- Line graph – Shows a timeline of incidents for each analytic type + +In the middle of the interface, you can view a list of the analytic types, number of attacks +identified in the last 24 hours per type, the ability to enable or disable monitoring, access to the +analytic configuration, and a tool tip with a brief summary of the analytic. + +:::info +For most analytics, configure at least one filter before enabling an analytic +type. +::: + + +The Refresh button on the Analytics ribbon repopulates both the graphical display and the analytic +list. + +The Permissions section at the bottom of the interface allows you to protect Analytic policies at +the Analytics node. Once a user is assigned permission, all analytic policies, configurations, and +data are protected from any user not included in the permissions list. See the +[Protect Policies](/docs/threatprevention/8.1/admin/policies/dataprotection.md#protect-policies) topic for instructions on how to +protect analytic policies. + +![Analytics node](/images/threatprevention/8.1/admin/analytics/analyticslist.webp) + +Directly under the Analytics node are the individual analytics nodes for accessing information on +the monitored incidents and configuring the analytic type: + +- [Brute Force Attacks Analytic Type](/docs/threatprevention/8.1/admin/analytics/bruteforceattacks.md) – Reports on failed attempts from a + single host to access a given host. It can be triggered by different user accounts with bad + passwords or invalid account names. +- [User Account Hacking Analytic Type](/docs/threatprevention/8.1/admin/analytics/useraccounthacking.md) – Reports on multiple bad passwords + provided for a given valid user account +- [Horizontal Movement Attacks Analytic Type](/docs/threatprevention/8.1/admin/analytics/horizontalmovementattacks.md) – Reports on security + principals that are accessing more than the threshold of resources during a specified time + interval. This may be indicative of a person trying to obtain information from as many servers as + possible which they normally would not be accessing. +- [Bad User ID (by User) Analytic Type](/docs/threatprevention/8.1/admin/analytics/baduseriduser.md) – Reports on pre-authentication failures + due to using account names that cannot be found in Active Directory. These incidents are grouped + per account name. +- [Bad User ID (by Source Host) Analytic Type](/docs/threatprevention/8.1/admin/analytics/baduseridsourcehost.md) – Reports on + pre-authentication failures due to using account names that cannot be found in Active Directory. + These incidents are grouped per source host. +- [Breached Password Analytic Type](/docs/threatprevention/8.1/admin/analytics/breachedpassword.md) – Reports on multiple failed + authentications followed by a successful authentication in a specified time frame +- [Concurrent Logins Analytic Type](/docs/threatprevention/8.1/admin/analytics/concurrentlogins.md) – Reports on logins from multiple locations + within a specified time frame +- [Impersonation Logins Analytic Type](/docs/threatprevention/8.1/admin/analytics/impersonationlogins.md) – Reports on multiple authenticated + accounts from a single system within a specified time frame +- [Golden Ticket Analytic Type](/docs/threatprevention/8.1/admin/analytics/goldenticket.md) – Reports on Kerberos tickets that exceed the + specified maximum lifetimes for a user ticket or maximum lifetimes for a user ticket renewal +- [File System Attacks (by User) Analytic Type](/docs/threatprevention/8.1/admin/analytics/filesystemattacksuser.md) – Reports on significant + number of file changes made by an account in a short time period +- [Kerberos Weak Encryption Analytic Type](/docs/threatprevention/8.1/admin/analytics/kerberosweakencryption.md) – Reports on Kerberos tickets + with RC4_HMAC_MD5 encryption +- [Forged PAC Analytic Type](/docs/threatprevention/8.1/admin/analytics/forgedpac.md) – Reports on Kerberos tickets with modified PAC diff --git a/docs/threatprevention/8.1/admin/analytics/useraccounthacking.md b/docs/threatprevention/8.1/admin/analytics/useraccounthacking.md new file mode 100644 index 0000000000..8d0f0c34bb --- /dev/null +++ b/docs/threatprevention/8.1/admin/analytics/useraccounthacking.md @@ -0,0 +1,166 @@ +--- +title: "User Account Hacking" +description: "User Account Hacking Analytic Type" +sidebar_position: 120 +--- + +# User Account Hacking Analytic Type + +The **User Account Hacking** analytic type identifies multiple bad passwords provided for a given +valid user account in the specified time interval. + +:::info +Configure a subset of accounts to be monitored in order to avoid the excessive +volume of event activity from monitoring all accounts. +::: + + +| User Account Hacking | | +| -------------------- | ------------------------------- | +| Definition | Repeated failed logins below lockout thresholds and/or over extended periods | +| Example | Malware or a bad actor on the network is attempting to compromise an account by guessing the account’s password repeatedly until access is granted. To circumvent built-in lockout policies in Active Directory, the malware or bad actor will only guess so many times before backing off, making sure not to lockout the account. After a period of time has expired, it will continue its routine until the password is guessed correctly. This type of attack is easily automated using a script. The quiet nature of this type of attack often results in the attack going undetected.
\*The Enterprise Admin account (SID ending in -500) in Active Directory cannot be locked out making it vulnerable to hacking and eventual breach. While Active Directory will show the account is locked out on the object itself, as soon as the correct password is supplied, the account will be automatically unlocked, giving the perpetrator “God-rights” to the enterprise. | +| Trigger | (X1 failed login attempts from an individual user account in Y1 minutes) OR (X2 failed login attempts from an individual user account in Y3 minutes) OR … | +| Recommended Settings | Set the number of attempts 1 or 2 increments below the organization’s Active Directory lockout policy settings. | + +**Analytic Workflow** + +1. Configure the analytic policy +2. Enable the analytic policy +3. Enable alerting on incidents through the + [System Alerting Window](/docs/threatprevention/8.1/admin/configuration/systemalerting/overview.md). + +See the User Account Hacking Analytic Data Grid topic for information on event data collected per +incident. + +## Configure User Account Hacking Analytic Policy + +Open the User Account Hacking Analytic Policy in any of the following ways: + +- Click Analytics in the left pane to launch the Analytics interface. Then click the gear icon for + the analytic. +- Expand the Analytics node and click the desired analytic. On the analytic window, click the gear + icon available in the top right corner. + +The Configure Analytics window has two tabs: + +- Settings – Where the analytic trigger is defined +- Policy – Where filters can be added, additional actions configured, a custom schedule set, and the + policy enabled + +**Settings Tab** + +![User Account Hacking Analytic Type - Settings tab](/images/threatprevention/8.1/admin/analytics/accounthackingsettings.webp) + +Set the Number of Failed Logins and the Interval Duration to trigger the incident. The interval +duration is set for (hours:minutes) and is capped at 23:59. When the specified number of failed +logins have occurred for an individual user account within the specified interval duration, it will +trigger an incident record. + +By default, authentication event data is cached in memory for 24 hours. When an incident is +triggered, an incident record is saved to the database along with the events that triggered the +incident. Raw authentication event data that did not contribute to an incident are purged from +memory once they are more than 24 hours old. + +- Click the **Add** **(+)** button to include additional triggers conditions. If any of the + specified conditions are met, it will trigger an incident. For example, one trigger condition can + be set to generate an incident if there are _5 Failed Logins_ during an interval of _1 minutes_, + and another trigger condition can be set to generate an incident if there are _10 Failed Logins_ + during an interval of _30 minutes_. If either condition is met, an incident is triggered. +- Use the **Remove** **(x)** button to remove trigger conditions. + +The **Configure Accounts** link will redirect you to the **Policy** > **Event Type** > **AD +Perpetrator** filter. + +If checked, the **Ignore failed logins for unresolved user names** option will exclude bad user IDs +from contributing to User Account Hacking incidents. + +**Policy Tab** + +![User Account Hacking Analytic Type - Policy tab](/images/threatprevention/8.1/admin/analytics/policytab.webp) + +The **Policy** tab for configuring analytics consists of three sub-tabs: + +- General tab – Configured the same way a regular policy’s [General Tab](/docs/threatprevention/8.1/admin/policies/configuration/general.md) is + configured. The only exception is that the Name and Description are hard coded, and cannot be + modified. The Tags field is disabled for analytics. +- Event Type tab – Configured the same way a regular policy’s + [Event Type Tab](/docs/threatprevention/8.1/admin/policies/configuration/eventtype/overview.md) is configured. The only exception is that the + [Authentication Monitoring Event Type](/docs/threatprevention/8.1/admin/policies/configuration/eventtype/authenticationmonitoring.md) is hard + coded, and the Success filter cannot be modified. + + - Scope the accounts to include in or exclude from being monitored on the AD Perpetrator filter. + - _Optional_: Scope the protocol to be monitored on the Authentication Protocol filter. If + enabling the analytic on a domain controller, also scope the login type. + + :::note + The Exclude failed authentications with ‘N-2’ passwords option requires a GPO + within the organization be configured to ‘Enforce password history’ with a setting of a + minimum of ‘3 passwords remembered’ or it will not have an effect. + ::: + + + - _Optional_: Scope the domains to be included in or excluded from monitoring on the + Domains/Servers filter. + - _Optional_: Scope the servers to be included in or excluded from monitoring on the IP + Addresses (from) filter, the IP Addresses (to) filter, the Hosts (from) filter, or the Hosts + (to) filter. + + :::note + Some authentication events may return only a host name (NetBIOS or FQDN), others + may return only an IP address. It is recommended to take this into account when entering + filter values. + ::: + + +- Actions tab – Configured the same way a regular policy’s + [Actions Tab](/docs/threatprevention/8.1/admin/policies/configuration/actions/overview.md) is configured. The only exceptions are that the + “Send to Event DB” and “Email Notifications” options are disabled. The event data collected by + analytic policies are stored in memory until an incident is triggered. For the “Send Raw Data to + SIEM” option, use _caution_, as this will send all event data not the triggered incident, which + could be a large volume of data. To send notifications on incidents, use the + [System Alerting Window](/docs/threatprevention/8.1/admin/configuration/systemalerting/overview.md) to configure Email and SIEM + alerts. + +## User Account Hacking Analytic Data Grid + +The data grid on the **User Account Hacking** node lists one row per incident identified. + +![User Account Hacking Analytic Type window](/images/threatprevention/8.1/admin/analytics/useraccounthacking.webp) + +The data grid can be filtered according to the Event Tracker status: All, New, or Reviewed. See the +[Event Tracker Window](/docs/threatprevention/8.1/admin/policies/configuration/recentevents/eventtracker.md) topic for additional information. + +The top data grid includes the following information for each incident: + +- Attacked Account Name – Security principal of the account that triggered the incident + + :::note + The name will be red if the attacking account is the Administrator account. + ::: + + +- Attacked Account SID – Security Identifier of the account used in the event +- First Attempt – Date timestamp of the first monitored event that triggered the incident. Hover + over the data in this column to view the local time (of the Enterprise Manager) and UTC time + simultaneously. +- Last Attempt – Date timestamp of the last event that triggered the incident. Hover over the data + in this column to view the local time (of the Enterprise Manager) and UTC time simultaneously. +- Number of Attempts – Number of attempts monitored during the specified interval matching this rule + +Select an incident in the top data grid to view information on the events that triggered the +incident: + +- From Host – Name of the originating host +- From Host IP Address – IP address of the originating host +- Protocol – Protocol(s) used for the monitored operation +- Access Type – Type of authentication, e.g. RDP, CIFS, etc. +- Status – Detailed information on the error generated by the event +- Detected on DC – Fully-qualified name of the domain controller that detected the event +- Events Count – Number of identical events that occurred in one minute +- Date/Time – Date timestamp of the monitored event. Hover over the data in this column to view the + local time (of the Enterprise Manager) and UTC time simultaneously. +- Agent Time Logged – Timestamp for when the Agent detected the event. This can be different from + the Enterprise Manager time (displayed in the Date/Time column) due to latency. + +This data grid employs features for sorting, filtering, searching, and more. See the +[ Data Grid Functionality](/docs/threatprevention/8.1/admin/navigation/datagrid.md) topic for additional information. diff --git a/docs/threatprevention/8.1/admin/configuration/_category_.json b/docs/threatprevention/8.1/admin/configuration/_category_.json new file mode 100644 index 0000000000..edfc42f1fc --- /dev/null +++ b/docs/threatprevention/8.1/admin/configuration/_category_.json @@ -0,0 +1,6 @@ +{ + "label": "Configuration", + "position": 30, + "collapsed": true, + "collapsible": true +} \ No newline at end of file diff --git a/docs/threatprevention/8.1/admin/configuration/accessanalyzerconfiguration.md b/docs/threatprevention/8.1/admin/configuration/accessanalyzerconfiguration.md new file mode 100644 index 0000000000..b630cbc665 --- /dev/null +++ b/docs/threatprevention/8.1/admin/configuration/accessanalyzerconfiguration.md @@ -0,0 +1,52 @@ +--- +title: "Send Active Directory Event Data from Netwrix Threat Prevention to Netwrix Access Analyzer" +description: "Send Active Directory Event Data from Netwrix Threat Prevention to Netwrix Access Analyzer" +sidebar_position: 90 +--- + +# Send Active Directory Event Data from Netwrix Threat Prevention to Netwrix Access Analyzer + +When Netwrix Threat Prevention is configured to monitor a domain, the event data collected by the +policies can be provided to Netwrix Access Analyzer (formerly Enterprise Auditor) for auditing and +analysis. This is accomplished by configuring Threat Prevention to send data to Netwrix Activity +Monitor, which in turn creates the activity log files that Access Analyzer collects. + +:::note +Threat Prevention can only be configured to send event data to one Netwrix application, +either Netwrix Activity Monitor or Netwrix Threat Manager but not both. However, the Activity +Monitor can be configured with outputs for Access Analyzer and Threat Manager. +::: + + +Follow the steps to configure this integration. + +:::info +It is a best practice to use the API Server option of the Activity Monitor for +this integration between Threat Prevention and Access Analyzer. +::: + + +**Step 1 –** In the Threat Prevention Administration Console, click **Configuration** > **Netwrix +Threat Manager Configuration** on the menu. The Netwrix Threat Manager Configuration window opens. + +**Step 2 –** On the Event Sink tab, configure the following: + +- Netwrix Threat Manager URI – Enter the name of the Activity Monitor agent host and port, which is + 4499 by default, in the following format: + + `amqp://localhost:4499` + + You must use localhost, even if Activity Monitor and Threat Prevention are installed on + different servers. + +- App Token – Leave this field blank for integration with Activity Monitor +- Policies – The table displays all policies created in Threat Prevention along with a State icon + indicating if the policy is active. Check the **Send** box for the desired policies monitoring the + target domain activity. + +**Step 3 –** Click **Save**. + +All real-time event data from the selected policies is now sent to Activity Monitor. Additional +policies can be added to this data stream through the Netwrix Threat Manager Configuration window or +by selecting the **Send to Netwrix Threat Manager** option on the Actions tab of the respective +policy. diff --git a/docs/threatprevention/8.1/admin/configuration/collectionmanager/_category_.json b/docs/threatprevention/8.1/admin/configuration/collectionmanager/_category_.json new file mode 100644 index 0000000000..d6eb3d18d8 --- /dev/null +++ b/docs/threatprevention/8.1/admin/configuration/collectionmanager/_category_.json @@ -0,0 +1,10 @@ +{ + "label": "Collection Manager Window", + "position": 10, + "collapsed": true, + "collapsible": true, + "link": { + "type": "doc", + "id": "overview" + } +} \ No newline at end of file diff --git a/docs/threatprevention/8.1/admin/configuration/collectionmanager/dynamic.md b/docs/threatprevention/8.1/admin/configuration/collectionmanager/dynamic.md new file mode 100644 index 0000000000..01a2a1f700 --- /dev/null +++ b/docs/threatprevention/8.1/admin/configuration/collectionmanager/dynamic.md @@ -0,0 +1,201 @@ +--- +title: "Dynamic Collections" +description: "Dynamic Collections" +sidebar_position: 20 +--- + +# Dynamic Collections + +Certain options in the upper-left corner of the +[Add New Collection Window](/docs/threatprevention/8.1/admin/configuration/collectionmanager/listcollections.md#add-new-collection-window) are only enabled for the +following collection categories: + +- Domains & Servers – Dynamic Domains & Servers Collection Table Requirements +- Objects – Dynamic Objects Collection Table Requirements +- Perpetrators and Lockdown Perpetrators – Dynamic Perpetrators Collections Table Requirements +- IP Addresses – Dynamic IP Addresses Collection Table Requirements +- Hosts – Dynamic Hosts Collection Table Requirements +- File Paths – Dynamic File Paths Collection Table Requirements + +![Options on the Add New Collection window](/images/threatprevention/8.1/admin/configuration/collectionmanager/addcollectionoptions.webp) + +- The _I will provide a list_ option button enables the default setting for a static collection. See + the [Add New Collection Window](/docs/threatprevention/8.1/admin/configuration/collectionmanager/listcollections.md#add-new-collection-window) topic to manually + add a new collection. +- The _I want a list to come from the database table_ option button enables a dynamic collection. + Enter the table name in the textbox that appears or select it from the drop-down menu. + +The dynamic collection tables can be populated manually or with a third-party product as long as +they meet the table requirements for the intended collection category. + +Any policy that has been assigned a dynamic collection uses the current table’s data for the policy +filter, resulting in a dynamic policy. + +Any changes to the selected table’s data are recognized by an active policy when the Agent +communicates with the Threat Prevention Enterprise Manager. This may result in a maximum delay of +five minutes between a change in the table and the Agent refresh. + +## Dynamic Domains & Servers Collection Table Requirements + +When using a dynamic Domains & Servers collection, the table to be referenced must meet the +following requirements: + +- Table Location – Must be in the NVMonitorConfig database +- Table Naming Convention – Must have a prefix of ‘dc*domain_server*’ +- Table Schema – Must have the following column: + +| Column Name | Column Type | Column Description | +| ---------------- | --------------- | --------------------------------------------- | +| DomainServerName | NVARCHAR (1024) | Name of the domain or server. Cannot be null. | + +Example table entry for domain: + +**ExampleDomain** + +Example table entry for server: + +**ExampleServer** + +:::note +Threat Prevention creates an empty table with the required prefix and schema if the [Table +name] entered does not exist in the NVMonitorConfig database. +::: + + +## Dynamic Objects Collection Table Requirements + +When using a dynamic Object collection, the table to be referenced must meet the following +requirements: + +- Table Location – Must be in the NVMonitorConfig database +- Table Naming Convention – Must have a prefix of ‘dc*ad_objects*’ +- Table Schema – Must have the following column: + +| Column Name | Column Type | Column Description | +| ----------- | --------------- | ---------------- | +| AdObject | NVARCHAR (1024) | Distinguished name of the Active Directory object. Cannot be null. | + +Example table entry: + +**CN=User,DC=Domain,DC=Local** + +:::note +Threat Prevention creates an empty table with the required prefix and schema if the [Table +name] entered does not exist in the NVMonitorConfig database. +::: + + +## Dynamic Perpetrators Collections Table Requirements + +When using a dynamic Perpetrators or Lockdown Perpetrators collection, the table to be referenced +must meet the following requirements: + +- Table Location – Must be in the NVMonitorConfig database +- Table Naming Convention – Must have a prefix of ‘dc*perpetrators*’ +- Table Schema – Must have the following columns: + +| Column Name | Column Type | Column Description | +| -------------- | --------------- | --------------------- | +| AccountName | NVARCHAR (1024) | Distinguished name of the account. Cannot be null. | +| AccountSid | NVARCHAR (184) | SDDL form of the account Security ID. Cannot be null. | +| AccountType | INT | Account type using the following values:
  • 0 = none
  • 1 = user
  • 2 = group
  • 3 = context
  • 4 = orgRole
  • 5 = sidtype
  • 6 = other
  • 7 = dynamic
  • 8 = dynamic_group
Cannot be null. | +| IncludeSubtree | INT | Indicates if child containers should be used:
  • 0 = Child containers NOT included
  • 1 = Child containers included
Cannot be null. | + +Example table entry: + +**CN=User,DC=Domain,DC=Local | S-1-5-21-1004336348-1177238915-682003330-500 | 3 | 0** + +:::note +Threat Prevention creates an empty table with the required prefix and schema if the [Table +name] entered does not exist in the NVMonitorConfig database. +::: + + +## Dynamic IP Addresses Collection Table Requirements + +When using a dynamic IP Addresses collection, the table to be referenced must meet the following +requirements: + +- Table Location – Must be in the NVMonitorConfig database +- Table Naming Convention – Must have a prefix of 'dc*ip_addresses*' +- Table Schema – Must have the following column: + +| Column Name | Column Type | Column Description | +| ----------- | --------------- | ------------------------------------ | +| IpAddress | NVARCHAR (1024) | Address of the host. Cannot be null. | + +Example table entry: + +192.168.1.3 + +:::note +Threat Prevention creates an empty table with the required prefix and schema if the [Table +name] entered does not exist in the NVMonitorConfig database. +::: + + +## Dynamic Hosts Collection Table Requirements + +When using a dynamic Hosts collection, the table to be referenced must meet the following +requirements: + +- Table Location – Must be in the NVMonitorConfig database +- Table Naming Convention – Must have a prefix of ‘dc*hosts*’ +- Table Schema – Must have the following columns: + +| Column Name | Column Type | Column Description | +| --------------- | --------------- | ----------------------------------------- | +| NetbiosHostName | NVARCHAR (1024) | Name of the host | +| DnsHostName | NVARCHAR (1024) | Domain Name System (DNS) name of the host | +| IpAddress | NVARCHAR (1024) | IP v4 Address of the host | +| IpV6Address | NVARCHAR (1024) | IP v6 Address of the host | + +\*\*At least one column cannot be null. + +Example table entry with all fields populated: + +**host | host.dc.com | 10.0.10.19 | fe80::4d72:80e9:72cf:425f%10** + +Example table entry tjat excludes IP v6 Address: + +**host | host.dc.com | 10.0.10.19 | [null]** + +Example table entry that excludes IP v4 Address: + +**host | host.dc.com | [null]  | fe80::4d72:80e9:72cf:425f%10** + +:::note +Threat Prevention creates an empty table with the required prefix and schema if the [Table +name] entered does not exist in the NVMonitorConfig database. +::: + + +## Dynamic File Paths Collection Table Requirements + +When using a dynamic File Paths collection, the table to be referenced must meet the following +requirements: + +- Table Location – Must be in the NVMonitorConfig database +- Table Naming Convention – Must have a prefix of 'dc*file_path*' +- Table Schema – Must have the following columns: + +| Column Name | Column Type | Column Description | +| -------------- | --------------- | --------------------- | +| Path | NVARCHAR (1024) | File path to the desired folder. Cannot be null. | +| IncludeSubtree | INT | Indicates whether or not subfolders are processed:
  • 0 = Not Included
  • 1 = Included
| +| TargetAgent | NVARCHAR (1024) | Agent that monitors the target server. Cannot be null. | + +Example table entry: + +**c:\Windows | 0 | ExampleFSserver** + +:::note +Threat Prevention creates an empty table with the required prefix and schema if the [Table +name] entered does not exist in the NVMonitorConfig database. +::: + + +Two tables are created during the installation/upgrade process for the File Path collections: + +- Folders with Sensitive Data Collection – dc_file_path_SensitiveDataFolders table +- Open Shares Collection – dc_file_path_OpenShares table diff --git a/docs/threatprevention/8.1/admin/configuration/collectionmanager/listcollections.md b/docs/threatprevention/8.1/admin/configuration/collectionmanager/listcollections.md new file mode 100644 index 0000000000..b0fb98f2c6 --- /dev/null +++ b/docs/threatprevention/8.1/admin/configuration/collectionmanager/listcollections.md @@ -0,0 +1,143 @@ +--- +title: "List of Collections Window" +description: "List of Collections Window" +sidebar_position: 10 +--- + +# List of Collections Window + +Use the List of Collections window to add new items to a collection as well as edit and remove +existing items. + +Click **Configuration** > **Collections** on the menu to launch the +[Collection Manager Window](/docs/threatprevention/8.1/admin/configuration/collectionmanager/overview.md). Then either double-click a Collection or select a +Collection and click the Manage button to open the List of Collections window. + +![List of Collections window](/images/threatprevention/8.1/admin/configuration/collectionmanager/listofcollections.webp) + +At the top of the window, the Collection Category is displayed. Each item in the list displays: + +- Name – Name of the collection +- Item Count – Number of items in the collection +- Dependency Count – Number of policies or policy templates referencing the collection + +Use the Add, Edit, Remove, Dependencies, and Export buttons to modify a collection. + +## Add New Collection Window + +Follow the steps to add a static collection. + +**Step 1 –** Click **Add** on the List of Collections window to open the Add New Collection window. + +![Add New Collections window](/images/threatprevention/8.1/admin/configuration/collectionmanager/addnewcollection.webp) + +**Step 2 –** Select an option: + +- The _I will provide a list_ option button enables the default setting for a static collection. +- The _I want a list to come from the database table_ option button enables a dynamic collection. + Enter the table name in the textbox that appears or select it from the drop-down menu. See the + [Dynamic Collections](/docs/threatprevention/8.1/admin/configuration/collectionmanager/dynamic.md) topic for additional information. + +**Step 3 –** Provide a unique, descriptive name for the collection in the name box. + +**Step 4 –** Provide a detailed description in the Description box. + +**Step 5 –** The Created By, Created On, Modified By, and Modified On boxes are automatically +populated when collections are created or changed. + +**Step 6 –** Use the Add (+) button to search for Items that match the selected Collection category. + +The Select… window opens. Select a server/Agent from the drop-down menu and click **Connect**. +Expand the domain tree in the navigation pane. Select an item in the Results pane on the right and +click **OK**. See the [Selection Windows](/docs/threatprevention/8.1/admin/policies/configuration/eventtype/window/overview.md) topic for +additional information. + +![Select window](/images/threatprevention/8.1/admin/configuration/collectionmanager/selectadobjects.webp) + +Use the **Remove** (x) button to remove Items from the list on the Add New Collection window. + +Some collection can be configured to be dynamic collections. See the +[Dynamic Collections](/docs/threatprevention/8.1/admin/configuration/collectionmanager/dynamic.md) topic for additional information. The Perpetrators and Lockdown +Perpetrators collections also have the option to expand group membership. See the Expand Groups +Option for Perpetrators & Objects Collection topic for additional information. + +**Step 7 –** When the configuration is set as desired, click **OK** to save the collection. + +## Expand Groups Option for Perpetrators & Objects Collection + +The Expand Groups option on the Add New Collection window is only available for the following +collections: + +- Perpetrators +- Lockdown Perpetrators +- Objects +- Lockdown Objects + +![Expand Groups option on the Add New Collection window](/images/threatprevention/8.1/admin/configuration/collectionmanager/expandgroups.webp) + +- For Perpetrators – If checked, the groups and nested-groups are expanded to monitor effective + group membership at the user level. This means the Agent monitors/blocks based on the user’s token + instead of the group’s token. The impact specifically for Lockdown Perpetrators collections is + that this option allows for the immediate blocking of a currently logged in user who has had a + group membership change while logged in. +- For Objects – If checked, when a group object is added, then the groups and nested-groups are + expanded to monitor effective group membership at the user level. This means the Agent + monitors/blocks based on the user’s token instead of the group’s token. The impact specifically + for Lockdown Objects collections is that this option allows for the immediate blocking of a + currently logged in user who has had a group membership change while logged in. + +The Expand Groups option does NOT apply to other object types. + +There is a maximum cap of 1000 users/objects that can be expanded. If the total number of users or +objects of the groups added to a single collection exceeds 1000, then the Agent defaults to +monitoring/blocking based on the groups’ tokens. + +If group membership cannot be resolved, then the Agent defaults to monitoring/blocking based on the +groups’ tokens. + +## Edit Collection Window + +**Step 1 –** Select a collection on the List of Collections window and click **Edit**. The Edit +Collection window opens. + +![Edit Collection Window](/images/threatprevention/8.1/admin/configuration/collectionmanager/editcollection.webp) + +**Step 2 –** You can modify the name, description, and items in the collection. See the Add New +Collection Window topic for additional information on these settings. + +## Remove Collection + +**Step 1 –** Select a collection on the List of Collections window and click **Remove**. + +:::note +You cannot delete a collection that is assigned to an active policy, as indicated in the +Dependency Count column. Remove a collection from all policies it has been assigned to before +deleting it. +::: + + +![Confirm Removal window](/images/threatprevention/8.1/admin/configuration/collectionmanager/confirmremoval.webp) + +**Step 2 –** Click **Yes** on the Confirm Removal window to delete the collection. + +## Collection Dependencies Window + +**Step 1 –** Select a collection on the List of Collections window and click **Dependencies** to +open the Collection Dependencies window. + +![Collection Dependencies Window](/images/threatprevention/8.1/admin/configuration/collectionmanager/dependencies.webp) + +**Step 2 –** This window displays a list of all policy templates and policies the selected +collection is assigned to. View the list and click **OK**. + +## Export Collections + +You can select one or more collections on the List of Collections window and export their +information to a TSV file. + +Follow the steps to export a collection in the list. + +**Step 1 –** Select one or more collections on the List of Collections window and click **Export**. + +**Step 2 –** The Save As window opens. It displays the default file name and location where it will +be saved. Modify if required and click **Save**. diff --git a/docs/threatprevention/8.1/admin/configuration/collectionmanager/overview.md b/docs/threatprevention/8.1/admin/configuration/collectionmanager/overview.md new file mode 100644 index 0000000000..c3b80831eb --- /dev/null +++ b/docs/threatprevention/8.1/admin/configuration/collectionmanager/overview.md @@ -0,0 +1,99 @@ +--- +title: "Collection Manager Window" +description: "Collection Manager Window" +sidebar_position: 10 +--- + +# Collection Manager Window + +The Collection Manager window enables you to manage all Microsoft Collections. Click +**Configuration** > **Collections** on the menu to launch it. This window is only available to +Threat Prevention administrators. + +![Collection Manager Window](/images/threatprevention/8.1/admin/configuration/collectionmanager/collectionmanager.webp) + +Collections are reusable lists of policy filter settings that help streamline the task of +associating filters with event types on the Event Type tab during +[Policy Configuration](/docs/threatprevention/8.1/admin/policies/configuration/configuration.md) or +[Template Configuration](/docs/threatprevention/8.1/admin/templates/configuration/configuration.md). They are configured globally and can be +used in multiple policies in place of or in conjunction with individual filters. These collections +are empty until you populate them with your environment information. When a collection is modified, +the modifications affect all policies referencing the collection. At least one Agent must be +deployed to populate Collections. + +To use policy templates to create new policies, Collections must be configured. Several templates +are configured using Collections as a policy filter. If the Collection is empty, then the policy +does not monitor what it was designed to monitor. + +Collections are organized into the following categories for Microsoft Collections: + +- Domains & Servers – Any domain or server (by name) +- Contexts – Any context (e.g. containers and organizational units) within Active Directory +- Objects – Any Active Directory object +- Exchange Objects – Any mail-enabled user accounts or distribution lists +- Lockdown Objects – Any Active Directory object, used for lockdown purposes +- Exchange Trustees – Any account that has permission to another account’s mailbox or folder +- Perpetrators – Any security principal that is making a change, used for monitoring purposes +- Lockdown Perpetrators – Any security principal that is making a change, used for lockdown purposes +- Exchange Perpetrators – Any security principal that is making a change in an Exchange environment, + used for both monitoring and lockdown purposes +- Classes – Any class within Active Directory +- Attributes – Any attribute within Active Directory +- ADCS Attributes – Any certificate attribute within Active Directory Certificate Services +- IP Addresses – Any client address +- Hosts – Any computer (by NetBIOS, DNS, and IP address) +- File Paths – List of file paths for Windows file systems to be used with multiple agents + +Select a collection category and click **Manage…** i to open the +[List of Collections Window](/docs/threatprevention/8.1/admin/configuration/collectionmanager/listcollections.md). + +## Preconfigured Collections + +Threat Prevention has the following pre-configured Collections: + +| Collection Type | Name | +| --------------------- | --------------------------------------------------------- | +| Domains and Servers | SBServers | +| Objects | Administrator Accounts | +| Objects | Administrator Groups | +| Objects | Sensitive Groups | +| Objects | Service Accounts | +| Perpetrators | Administrative Accounts | +| Perpetrators | Domain Administrators | +| Perpetrators | Failed Authentications | +| Perpetrators | Service Accounts | +| Perpetrators | Successful Authentications | +| Perpetrators | Successful HIPPAA PHI Account Authentications | +| Perpetrators | System Accounts | +| Lockdown Perpetrators | Allow Perpetrators | +| Lockdown Perpetrators | Critical GPO - Allow Perpetrators | +| Lockdown Perpetrators | DNS Records - Allow Perpetrators | +| Lockdown Perpetrators | GPOs - Allow  Perpetrators | +| Lockdown Perpetrators | Group Lockdown - Allow Perpetrators | +| Lockdown Perpetrators | Group User OU Object Delete and Move - Allow Perpetrators | +| Lockdown Perpetrators | Object Permissions - Allow Perpetrators | +| Lockdown Perpetrators | OU Structure - Allow Perpetrators | +| Lockdown Perpetrators | Root Object - Allow Perpetrators | +| Lockdown Perpetrators | User Lockdown - Allow Perpetrators | +| Classes | Exclude Classes | +| Classes | Threat Manager - AD Excluded Classes | +| Attributes | Exclude Attributes | +| Attributes | Exclude User Attributes | +| Attributes | Property Set: DNS-Host-Name-Attributes | +| Attributes | Property Set: Domain-Other-Parameters | +| Attributes | Property Set: Domain-Password | +| Attributes | Property Set: General-Information | +| Attributes | Property Set: Membership | +| Attributes | Property Set: Personal-Information | +| Attributes | Property Set: Private-Information | +| Attributes | Property Set: Public-Information | +| Attributes | Property Set: RAS-Information | +| Attributes | Property Set: Terminal-Server-License-Server | +| Attributes | Property Set: User-Account-Restrictions | +| Attributes | Property Set: User-Login | +| Attributes | Property Set: Web-Information | +| Attributes | Threat Manager - AD Excluded Attributes | +| Hosts | Domain Controllers | +| Hosts | Exchanges Servers | +| File Paths | Folders with Sensitive Data. If you | +| File Paths | Open Shares | diff --git a/docs/threatprevention/8.1/admin/configuration/databasemaintenance/_category_.json b/docs/threatprevention/8.1/admin/configuration/databasemaintenance/_category_.json new file mode 100644 index 0000000000..edc3426e71 --- /dev/null +++ b/docs/threatprevention/8.1/admin/configuration/databasemaintenance/_category_.json @@ -0,0 +1,10 @@ +{ + "label": "Database Maintenance Window", + "position": 20, + "collapsed": true, + "collapsible": true, + "link": { + "type": "doc", + "id": "overview" + } +} \ No newline at end of file diff --git a/docs/threatprevention/8.1/admin/configuration/databasemaintenance/archive.md b/docs/threatprevention/8.1/admin/configuration/databasemaintenance/archive.md new file mode 100644 index 0000000000..56f098019a --- /dev/null +++ b/docs/threatprevention/8.1/admin/configuration/databasemaintenance/archive.md @@ -0,0 +1,112 @@ +--- +title: "Archive Data" +description: "Archive Data" +sidebar_position: 20 +--- + +# Archive Data + +To use the Move operation on the [Database Maintenance Window](/docs/threatprevention/8.1/admin/configuration/databasemaintenance/overview.md), you must specify a +database where data is archived. You can also define settings to delete data aged beyond a specified +threshold from the archive database. + +:::info +Consider periodically retiring the current archive database and creating a new +one. Depending on the size of the archive database, it could be yearly or every few years. +::: + + +## Configure the Archive Database + +Follow the steps to configure settings for the archive database. + +**Step 1 –** Click **Configuration** > **Database** > **Maintenance** on the menu. The Database +Maintenance window is displayed. Click the **Archive DB** tab. + +![Database Maintenance window - Archive DB tab](/images/threatprevention/8.1/admin/configuration/databasemaintenance/archivedb.webp) + +**Step 2 –** Enter the following information for the database where data is to be archived: + +- Server – SQL Server where the archive database is located +- Port – Instance port number, by default this is set to 0 +- Database – Name of the archive database +- Authentication + - For Windows Authentication – Check the Use Windows Authentication box + - For SQL Authentication – Enter theuser name and password of an account to use for SQL + authentication + +**Step 3 –** Click **Save** to save the configurations. + +To query archived event data, use the Investigate interface. See the +[Investigate Interface](/docs/threatprevention/8.1/admin/investigate/overview.md) topic for additional information. + +## Enable Database Maintenance for the Archive Database + +You can specify settings to automatically delete archived data that has aged beyond a specified +threshold. The threshold can be set per Event Type, per Analytics, and/or per Policy. While all +three options can be enabled with different retention periods, the Event Type maintenance settings +take precedence over Policy maintenance settings where the selected policy employs that event type. + +Alerts generated for the archive database maintenance job are displayed on the +[Alerts Interface](/docs/threatprevention/8.1/admin/alerts/overview.md) with "Archive DB:" as prefix in the Message column. +This helps differnciate between alerts generated for database maintenance and archive database +maintenance. + +Follow the steps to enable database maintenance for the archive database. + +**Step 1 –** Click **Configuration** > **Database** > **Maintenance** on the menu. The Database +Maintenance window is displayed. Click the **Archive DB** tab. + +Make sure archive database settings have been configured and the archiving process has run at least +once. + +**Step 2 –** Click the **Configure Archive DB Maintenance** button. The Archive DB Maintenance +window is displayed. + +![Archive DB Maintenance window](/images/threatprevention/8.1/admin/configuration/databasemaintenance/archivedbmaintenance.webp) + +The following information is displayed at the top of the window: + +- Archive Database Information: + +> > - Server – SQL Server where database maintenance is performed +> > - Database – Name of the database +> > - Database Size – Current size of the database +> > - Oldest Data – Date of the oldest data in the database + +- Job Information: + - Last run – Date timestamp when the last database maintenance job was executed + - Status – Status of the job. Different statuses are: + - Idle – Indicates that no database maintenance task is running + - Succeeded – Indicates that the most recent job finished without error + - Running – Indicates that a job is running + - Error – Indicates that the job started but terminated on an error + - Running Step – During job execution, this field populates with the step being executed + - Elapsed Time – Overall elapsed time of job execution + +The Refresh button in the upper-right corner refreshes this database and job information. + +**Step 3 –** From the Run SQL Agent job on drop-down menu, select an option to determine the SQL +Agent that will run the maintenance job. + +- Select **Main DB** if the archive database resides on the same SQL Server machine as the + NVMonitorData database. +- Select **Archive DB** if the archive database resides on a different SQL Server machine than the + NVMonitorData database. + +**Step 4 –** On the Event Type, Analytics, and/or Policy tabs, enable maintenance for all or some of +the options. See the [Enable Database Maintenance](/docs/threatprevention/8.1/admin/configuration/databasemaintenance/enable.md) topic for additional information. + +The [Event Type Tab](/docs/threatprevention/8.1/admin/configuration/databasemaintenance/overview.md#event-type-tab), [Analytics Tab](/docs/threatprevention/8.1/admin/configuration/databasemaintenance/overview.md#analytics-tab), and +[Policy Tab](/docs/threatprevention/8.1/admin/configuration/databasemaintenance/overview.md#policy-tab) on the Archive DB Maintenance window are the same as on the +Database Maintenance window, except that only the 'Delete' operation is available for the archive +database. + +**Step 5 –** On the Schedule tab, set the frequency and time when the database maintenance job runs. +See the [Schedule Database Maintenance](/docs/threatprevention/8.1/admin/configuration/databasemaintenance/schedule.md) topic for additional information. + +**Step 6 –** Click **OK** on the Archive DB Maintenance window. + +**Step 7 –** Click **Save** on the Database Maintenance window to save the changes. + +Database maintenance is now enabled for the archive database. diff --git a/docs/threatprevention/8.1/admin/configuration/databasemaintenance/enable.md b/docs/threatprevention/8.1/admin/configuration/databasemaintenance/enable.md new file mode 100644 index 0000000000..def48b7617 --- /dev/null +++ b/docs/threatprevention/8.1/admin/configuration/databasemaintenance/enable.md @@ -0,0 +1,52 @@ +--- +title: "Enable Database Maintenance" +description: "Enable Database Maintenance" +sidebar_position: 10 +--- + +# Enable Database Maintenance + +Database maintenance can be enabled for all or specific event types, analytics, and/or policies. It +can be enabled for any combination of event type data, analytic data, and policy data. + +:::tip +Remember, the Event Type maintenance settings take precedence over Policy maintenance settings +where the selected policy employs that event type. +::: + + +Follow the steps to enable database maintenance. + +**Step 1 –** Click **Configuration** > **Database** > **Maintenance** on the menu. The Database +Maintenance window is displayed. + +**Step 1 –** Select the desired tab (Event Type, Analytics, or Policy) and check the **Enabled** box +at the top of the tab. + +![Database Maintenance window - Event Type tab](/images/threatprevention/8.1/admin/configuration/databasemaintenance/enablesettings.webp) + +**Step 2 –** Select a maintenance task (Event Type, Analytic, or Policy). To set the same operation +and retention period for multiple tasks, use the **ctrl-left click** command. + +**Step 3 –** Select either **Move** or **Delete** from the Operation drop-down menu. + +- The Move operation requires the Archive DB tab to be configured. See the + [Archive Data](/docs/threatprevention/8.1/admin/configuration/databasemaintenance/archive.md) topic for additional information. + +**Step 4 –** Set the Retention Period value and unit (Day, Week, or Month). This value indicates the +age of the data to be kept when the database maintenance job is run. Older data is deleted or +moved/archived as indicated by the selected Operation. + +**Step 5 –** Click **Set**. + +**Step 6 –** Check the **Enable** box to include the tasks in the next database maintenance job. +Only those event types, analytics, and/or policies with the Enabled checkbox selected are included +in the job execution. + +**Step 7 –** Click **Save**. + +The configured maintenance options are displayed in the Operation and Retention Period columns of +the table. + +Disabling a previously enabled database maintenance task does not remove the configured settings, +only prevents that task from being executed in the next run of the database maintenance job. diff --git a/docs/threatprevention/8.1/admin/configuration/databasemaintenance/overview.md b/docs/threatprevention/8.1/admin/configuration/databasemaintenance/overview.md new file mode 100644 index 0000000000..1254961cd5 --- /dev/null +++ b/docs/threatprevention/8.1/admin/configuration/databasemaintenance/overview.md @@ -0,0 +1,166 @@ +--- +title: "Database Maintenance Window" +description: "Database Maintenance Window" +sidebar_position: 20 +--- + +# Database Maintenance Window + +The database maintenance function grooms the NVMonitorData database to optimize performance. It +automatically deletes or archives data aged beyond a specified threshold. The threshold can be set +per Event Type, per Analytics, and/or per Policy. While all three options can be enabled with +different retention periods, the Event Type maintenance settings take precedence over Policy +maintenance settings where the selected policy employs that event type. + +If you choose to archive data instead of deleting it, then you have to specify a database for data +archiving. For this database, you can also define settings to delete data aged beyond a specified +threshold. + +:::tip +Remember, See the Database Maintenance Permission details in the +[Database Maintenance Feature Requirements](/docs/threatprevention/8.1/requirements/sqlserver/dbmaintenance.md) topic. +::: + + +See the [Stored Procedures](/docs/threatprevention/8.1/admin/configuration/databasemaintenance/storedprocedures.md) topic for additional information on stored +procedures Threat Prevention uses on its SQL Server databases. + +Follow the steps to configure database maintenance. + +**Step 1 –** Click **Configuration** > **Database** > **Maintenance** on the menu. The Database +Maintenance window is displayed. + +This window is only available to Threat Prevention administrators. + +![Threat Prevention WinConsole Warning window](/images/threatprevention/8.1/admin/configuration/databasemaintenance/warning.webp) + +The database maintenance feature is only available if the SQL Server Agent service is running on the +SQL Server host. A warning message displays instead of the Database Maintenance window if this +service is not running. + +To enable the service, go to **Start** > **Administrative Tools** > **Services** interface and start +the SQL Server Agent (MSSQLSERVER). + +When the SQL Server Agent service is running, the Database Maintenance window opens. + +![Database Maintenance window](/images/threatprevention/8.1/admin/configuration/databasemaintenance/databasemaintenance.webp) + +The following information is displayed at the top of the window: + +- Database Information: + +> - Server – SQL Server where database maintenance is performed +> - Database – Name of the database +> - Database Size – Current size of the database +> - Oldest Data – Date of the oldest data in the database + +- Job Information: + - Last run – Date timestamp when the last database maintenance job was executed + - Status – Status of the job. Different statuses are: + - Idle – Indicates that no database maintenance task is running + - Succeeded – Indicates that the most recent job finished without error + - Running – Indicates that a job is running + - Error – Indicates that the job started but terminated on an error + - Running Step – During job execution, this field populates with the step being executed + - Elapsed Time – Overall elapsed time of job execution + +The Refresh button in the upper-right corner refreshes this database and job information. + +**Step 2 –** On the Event Type, Analytics, and/or Policy tabs, enable maintenance for all or some of +the options. See the [Enable Database Maintenance](/docs/threatprevention/8.1/admin/configuration/databasemaintenance/enable.md) topic for additional information. + +**Step 3 –** On the Schedule tab, set the frequency and time when the database maintenance job runs. +See the [Schedule Database Maintenance](/docs/threatprevention/8.1/admin/configuration/databasemaintenance/schedule.md) topic for additional information. + +**Step 4 –** To use the Move operation, you must specify a database on the Archive DB tab. You can +also define settings to delete data aged beyond a specified threshold from the archive database. See +the [Archive Data](/docs/threatprevention/8.1/admin/configuration/databasemaintenance/archive.md) topic for additional information. + +**Step 5 –** Click **Save** to save the changes. + +:::info +The SQL Server databases should be configured to use 'Simple Recovery Mode' in +the [SQL Server Requirements](/docs/threatprevention/8.1/requirements/sqlserver/sqlserver.md). This configuration has a direct +impact on the size of the transaction log during database maintenance delete tasks. If Simple +Recovery Mode is not configured on the databases, the transaction log may get quite large during +delete tasks. +::: + + +## Event Type Tab + +The Event Type tab is displayed by default when the Database Maintenance window opens. + +![Database Maintenance window - Event Type tab](/images/threatprevention/8.1/admin/configuration/databasemaintenance/eventtype.webp) + +Check the **Enabled** box at the top to set database maintenance by event type. The table contains +the following information: + +- Enable – Checked box indicates database maintenance is enabled for the event type +- Event Type – Data is grouped by the following event types: + - Active Directory – Configure maintenance for all event data collected by the Active Directory + Changes, Active Directory Lockdown, Active Directory Read Monitoring, AD Replication + Monitoring, AD Replication Lockdown, Effective Group Membership, FSMO Role Monitoring, GPO + Setting Lockdown, GPO Setting Changes, LSASS Guardian – Monitor, LSASS Guardian – Protect, and + Password Enforcement Event Types + - Authentications – Configure maintenance for all event data collected by the Authentication + Monitoring and Authentication Lockdown Event Types. This does not apply to Analytics policy + data + - Exchange – Configure maintenance for all event data collected by the Exchange Changes and + Exchange Lockdown Event Types + - File System – Configure maintenance for all event data collected by the File System Changes, + File System Lockdown, and File System Enterprise Auditor Event Types + - LDAP – Configure maintenance for all event data collected by the LDAP Monitoring, LDAP + Lockdown, and LDAP Bind Monitoring Event Types +- Operation – The operation set for the event type: Move (for archiving) or Delete +- Retention Period – The age of data to be retained when the database maintenance job is executed + for the event type + +## Analytics Tab + +Click the **Analytics** tab on the Database Maintenance window. + +![Database Maintenance window - Analytics tab](/images/threatprevention/8.1/admin/configuration/databasemaintenance/analytics.webp) + +Check the **Enabled** box at the top to set database maintenance by analytic. The table contains the +following information: + +- Enable – Checked box indicates database maintenance is enabled for the analytic +- Analytic Name – Name of each analytic +- Operation – The operation set for the analytic: Move (for archiving) or Delete +- Retention Period – The age of data to be retained when the database maintenance job is executed + for the analytic +- Incident Count – The number of incidents recorded in the database for each analytic +- Event Count – The number of events for the recorded incidents in the database for each analytic + +The rows in the table can be sorted alphanumerically by the Analytic Name, Incident Count, or Event +Count column. + +Above the table is a cumulative count of: + +- Total Incidents – The number of incidents recorded in the database for all analytics +- Total Events – The number of events for the recorded incidents in the database for all analytics + +## Policy Tab + +Click the **Policy** tab on the Database Maintenance window. + +![Database Maintenance window - Policy tab](/images/threatprevention/8.1/admin/configuration/databasemaintenance/policy.webp) + +Check the **Enabled** box at the top to set database maintenance by policy. The table contains the +following information: + +- Enable – Checked box indicates database maintenance is enabled for the policy +- Policy – Name of each policy you have created. Policies are listed in alphanumeric order, first + live policies (whether or not they are enabled) and then the deleted policies are listed +- Operation – The operation set for the policy: Move (for archiving) or Delete +- Retention Period – The age of data to be retained when the database maintenance job is executed + for the policy +- Event Count – The number of events for the recorded incidents in the database for each policy + +Above the table is a cumulative count of: + +- Total Events – The number of events for the recorded incidents in the database for all policies + +The rows in the table can be sorted alphanumerically by the Policy or Event Count column. Deleted +policies are always listed after all other policies. diff --git a/docs/threatprevention/8.1/admin/configuration/databasemaintenance/schedule.md b/docs/threatprevention/8.1/admin/configuration/databasemaintenance/schedule.md new file mode 100644 index 0000000000..2a993ddf0e --- /dev/null +++ b/docs/threatprevention/8.1/admin/configuration/databasemaintenance/schedule.md @@ -0,0 +1,53 @@ +--- +title: "Schedule Database Maintenance" +description: "Schedule Database Maintenance" +sidebar_position: 30 +--- + +# Schedule Database Maintenance + +You must schedule the database maintenance job, which runs the specified operation on each of the +enabled event type data, analytic data, and/or policy data older than a specific period. This job +can be run once now; it can be scheduled to run once at a later time; or it can be scheduled to run +on a regular rotation. + +Follow the steps to configure a schedule. + +![Database Maintenance window - Schedule tab](/images/threatprevention/8.1/admin/configuration/databasemaintenance/schedule.webp) + +**Step 1 –** Click **Configuration** > **Database** > **Maintenance** on the menu. The Database +Maintenance window is displayed. + +**Step 1 –** Click the **Schedule** tab. + +**Step 1 –** Check the **Enabled** box. + +**Step 2 –** Select a frequency to run the database maintenance job: + +- One Time: Run now – Runs the database maintenance job once when the configurations on the Database + Maintenance window are saved +- One Time: Run later – Runs the database maintenance job once according to the Start Date and Start + Time set +- Daily – Runs the database maintenance job once a day according to the Start Date and Start Time + set +- Weekly – Runs the database maintenance job once a week according to the Day Of Week, Start Date, + and Start Time set +- Monthly – Runs the database maintenance job once a month according to the Day of Month, Start + Date, and Start Time set + +**Step 3 –** Set the options under When for the selected frequency. + +- Start Date +- Start Time +- Day of Week (if applicable) +- Day of Month (if applicable) + +**Step 4 –** Click **Save** to save the settings. + +The database maintenance job is now scheduled to run at the configured time and day. All enabled +tasks at the time when the job runs are executed. + +This scheduled job can be viewed through the Microsoft SQL Server Management Studio within the **SQL +Server Agent** > **Jobs** folder (SiDbMainJob). + +![Database Maintenance job in Microsoft SQL Server Management Studio](/images/threatprevention/8.1/admin/configuration/databasemaintenance/dbmaintenancejob.webp) diff --git a/docs/threatprevention/8.1/admin/configuration/databasemaintenance/storedprocedures.md b/docs/threatprevention/8.1/admin/configuration/databasemaintenance/storedprocedures.md new file mode 100644 index 0000000000..5653fe9ded --- /dev/null +++ b/docs/threatprevention/8.1/admin/configuration/databasemaintenance/storedprocedures.md @@ -0,0 +1,24 @@ +--- +title: "Stored Procedures" +description: "Stored Procedures" +sidebar_position: 40 +--- + +# Stored Procedures + +The table contains a list of the stored procedures Threat Prevention uses on its SQL Server +databases. See the [Database Maintenance Window](/docs/threatprevention/8.1/admin/configuration/databasemaintenance/overview.md) topic for additional information. + +| Name | When Threat Prevention Uses the Procedure | What the Stored Procedure Does | +| ------------------ | ---------------------- | ---------------- | +| DeleteAuthAnalytics | Called from the SQLAgent job if the “Delete” operation is selected for database maintenance for Authentication Analytics. | This stored procedure deletes “old” data from the database in the following tables:
  • A_Login
  • A_Login2Policy
  • AR_BruteForceAttacks
  • AR_UserAccountHackingAttacks
  • AR_HorizontalMovementAttacks
  • AR_BadUserIdByUser
  • AR_BadUserIdByHost
  • AR_BreachedPassword
  • AR_ConcurrentLogins
  • AR_DiamondPAC
  • AR_EventTracker
  • AR_ImpersonationLogins
  • AR_GoldenTickets
  • AR_KerberosWeakEncryption
| +| DeleteByPolicy | Called from the SQLAgent job if the “Delete” operation is selected for database maintenance for selected policies. | This stored procedure deletes “old” data from the database in the following tables:
  • NvEvent
  • NvEvent_EventTracker
  • AttributeValue
  • OldAttributeValue
  • EventPolicy
  • E_LDAP
  • E_LDAP_EventTracker
  • E_LDAP2Policy
| +| DeleteFSAnalytics | Called from the SQLAgent job if the “Delete” operation is selected for database maintenance File System Analytics. | This stored procedure deletes “old” data from the database in the following tables:
  • A_FS
  • A_FS2Policy
  • AR_FilesPerUser
  • AR_EventTracker
| +| Delete LDAP | Called from the SQL Agent job if the “Delete” operation is selected for database maintenance for the LDAP Event Type. | This stored procedure deletes “old” data from the database in the following tables:
  • E_LDAP
  • E_LDAP_EventTracker
  • E_LDAP2Policy
| +| DeleteNvEventByEventType | Called from the SQL Agent job if the “Delete” operation is selected for database maintenance for all Event Types except LDAP. | This stored procedure deletes “old” data from the database in the following tables:
  • NvEvent
  • NvEvent_EventTracker
  • AttributeValue
  • OldAttributeValue
  • EventPolicy
| +| MoveAuthAnalytics | Called from the SQLAgent job if the “Move” operation is selected for database maintenance for Authentication Analytics. | This stored procedure moves “old” data from one database to another in the following tables:
  • A_Login
  • A_Login2Policy
  • AR_BruteForceAttacks
  • AR_UserAccountHackingAttacks
  • AR_HorizontalMovementAttacks
  • AR_BadUserIdByUser
  • AR_BadUserIdByHost
  • AR_BreachedPassword
  • AR_ConcurrentLogins
  • AR_DiamondPAC
  • AR_EventTracker
  • AR_ImpersonationLogins
  • AR_GoldenTickets
  • AR_KerberosWeakEncryption
| +| MoveByPolicy | Called from the SQLAgent job if the “Move” operation is selected for database maintenance for selected policies. | This stored procedure moves “old” database from one database to another in the following tables:
  • NvEvent
  • NvEvent_EventTracker
  • AttributeValue
  • OldAttributeValue
  • EventPolicy
  • E_LDAP
  • E_LDAP_EventTracker
  • E_LDAP2Policy
| +| MoveFSAnalytics | Called from the SQLAgent job if the “Move” operation is selected for database maintenance for File System Analytics. | This stored procedure moves “old” data from one database into another in the following tables:
  • A_FS
  • A_FS2Policy
  • AR_FilesPerUser
  • AR_EventTracker
| +| Move LDAP | Called from the SQLAgent job if the “Move” operation is selected for database maintenance for LDAP Event Type. | This stored procedure moves “old” data from one database into another in the following tables:
  • E_LDAP
  • E_LDAP_EventTracker
  • E_LDAP2Policy
| +| MoveNvEventsByEventType | Called from the SQLAgent job if the “Move” operation is selected for database maintenance for all Event Types except LDAP. | This stored procedure moves “old” data from one database to another in the following tables:
  • NvEvent
  • NvEvent_EventTracker
  • AttributeValue
  • OldAttributeValue
  • EventPolicy
| +| RdbPolicyCopy | Called from the SQLAgent job if the “Move” operation is selected for database maintenance. | This stored procedure creates a copy of the RdbPolicy table in the target database. | diff --git a/docs/threatprevention/8.1/admin/configuration/epesettings.md b/docs/threatprevention/8.1/admin/configuration/epesettings.md new file mode 100644 index 0000000000..cbb10d363d --- /dev/null +++ b/docs/threatprevention/8.1/admin/configuration/epesettings.md @@ -0,0 +1,430 @@ +--- +title: "EPE Settings Window" +description: "EPE Settings Window" +sidebar_position: 30 +--- + +# EPE Settings Window + +Threat Prevention can be configured with Enterprise Password Enforcer (EPE) to use the Have I Been +Pwned (HIBP) database. A copy of this database is hosted on the Netwrix website. The HIBP database +contains a list of the hashes of known compromised passwords. During password change operations, the +application can be configured to reject passwords with a hash that matches a hash in the HIBP +database. The EPE Settings window displays current HIBP database information and configuration +options. + +The HIBP database must be initially deployed to the Enterprise Manager. Once the database is stored, +Threat Prevention Agent(s) can be configured to obtain and use a local copy of the HIBP database. In +order to give Threat Prevention Agent(s) a local copy of the database, enable the **Use Local Pwned +hash DB** setting in the Deploy Agents wizard's +[Set Options Window ](/docs/threatprevention/8.1/admin/agents/deploy/setoptions.md). + +Password hashes can be authenticated against the stored HIBP database in the following places across +the environment: + +- Only the Enterprise Manager +- All or selected Threat Prevention Agent(s) +- Mix of the Enterprise Manager and Threat Prevention Agent(s) + +## Considerations When Deploying the HIBP Database + +Prior to deploying the HIBP database, consider the pros and cons when choosing its deployment +location. It can be deployed on the Threat Prevention Agent and/or the Enterprise Manager machine. + +:::tip +Remember, both the Agent and the Enterprise Manager can be in one environment. +::: + + +If the HIBP database is copied to and stored on the Agent: + +- The HIBP database takes up additional space on the machine where it is copied (approximately 8 + GB, but subject to change) +- A network connection to the application server is not required to check passwords against the HIBP + database +- The pending password candidate is checked against the archived hash file at the local Agent level. + The results are sent to the Enterprise Manager. If a password hash is matched, the pending + password change is rejected. +- The Enterprise Manager periodically compares its HIBP database version against the Agent's local + copy. If the Enterprise Manager has a newer copy, it updates the Agent copy. + +If the HIBP database is kept only on the Enterprise Manager: + +- The database takes up space only on the Enterprise Manager machine, not on the Agent machine +- Requires a working network connection from the Agent to the Enterprise Manager to check: + + - The pending password candidate from the Agent + - For and obtain updates to the HIBP database + +- The Agent sends the candidate hash value to the Enterprise Manager to compare against the + Enterprise Manager’s copy of the HIBP database + + - The advantage of this approach is that the HIBP database space is not required on the domain + controllers. The disadvantage is that at the time of a password change, if the Enterprise + Manager is not available, the Agent must assume the hash is okay. + +## Configuration Settings + +Click **Configuration > EPE Settings** on the menu to open the EPE Settings window. + +:::note +The EPE Settings window is only available to Threat Prevention administrators. +::: + + +![EPE Settings window](/images/threatprevention/8.1/admin/configuration/epesettings.webp) + +The window displays current hash database information and has the following configuration settings, +displayed in sections on the window. + +### Current Hash DB Info + +The Current hash DB Info area is enabled after the HIBP database has been deployed to Enterprise +Manager for the first time. It displays the source from where the database was downloaded, its size, +version, and the number of hashes it contains. It also shows a thumbprint value that changes +whenever the content of the Hash DB changes. + +:::tip +Remember, the HIBP dataset is updated at random intervals by its publisher. It can go weeks or +even months with no changes. +::: + + +### Check for Update Options + +The Check for Update options area specifies when the Netwrix website is checked for a new version of +the HIBP database. + +:::note +These options are enabled after the HIBP database has been deployed to Enterprise Manager +for the first time. +::: + + +Configure the following options: + +- Check update every [number] [unit of time] – Select how often the Netwrix website is checked for a + newer version of the HIBP database +- Start at [time] [day] – Select the time and day when Threat Prevention will check the Netwrix + website for a newer version of the HIBP database +- Check for new version – Checks the Netwrix website for the latest password hash file details and + compares the SHA-1 to the local hash file to determine if the website has a newer version of the + HIBP database. If only this option is selected, then an alert is generated in the Administration + Console when a new version is detected. + + :::note + This checkbox does not automatically download the new HIBP database version. + ::: + + +- Update pwned DB on new version – Checks the Netwrix website for HIBP updates and then updates the + Enterprise Manager server if a new version is detected + +After making selections, click the **Apply** button to enable checking for updates at the scheduled +intervals. + +### Passwords Hash Database + +Threat Prevention utilizes the Passwords Hash database to check if users’ new and pending password +(i.e. during a password reset) matches the hash of a compromised password from a data breach. + +:::note +First-time configuration of this window requires downloading the HIBP database from the +Netwrix website. If the Administration Console does not have internet access, see the Download and +Configure the Have I Been Pwned Hash List topic for instructions. +::: + + +:::warning +Ensure the initial update of the database occurs during non-office hours. Due to the +size of the hash file, this download takes up a significant amount of CPU and download time. +::: + + +- Passwords Hash Database Folder (path on Threat Prevention Server) – Central location of the Pwned + database on the application server. The default path is: + +**…\Netwrix\Netwrix Treat Prevention\SIEnterpriseManager\PwnedStore** + + + +- Location: + + - File – If the application server does not have internet access, you can manually download the + HIBP database and select the **File** radio button to browse to your local copy of the + database. + + Database Download link: + - [https://releases.netwrix.com/resources/stealthintercept/stealthintercept-hibp-database-2.0.0.zip](https://releases.netwrix.com/resources/stealthintercept/stealthintercept-hibp-database-2.0.0.zip) + + SHA-256 hash for the database: + - [https://releases.netwrix.com/resources/stealthintercept/stealthintercept-hibp-database-2.0.0.zip.sha256.txt](https://releases.netwrix.com/resources/stealthintercept/stealthintercept-hibp-database-2.0.0.zip.sha256.txt) + + - Website – This option points to the Netwrix website that hosts a copy of the latest HIBP + database. This is the default option and the preferred method if the application server has + internet access. + +- Apply: + + - If Website is selected, then clicking **Apply** downloads the HIBP database from the Netwrix + website and then processes the database for use by the application + - If File is selected, then clicking **Apply** will process the local copy of the (manually + obtained) database for use by the application + +### User Feedback Module + +The optional EPE User Feedback module (also known as the Credential Provider) provides feedback to +end users by listing the reasons the Enterprise Password Enforcement (EPE) event type has rejected a +candidate password. + +EPE offers multi-language support, ensuring users receive clear and consistent password rejection +messages. Supported languages are: + +- Chinese Simplified +- Chinese Traditional +- Czech +- Dutch +- English +- French +- German +- Hungarian +- Italian +- Japanese +- Korean +- Polish +- Portuguese +- Spanish +- Thai + +:::tip +Remember, the module must be deployed to end user computers. +::: + + +The User Feedback Module section has the following check boxes: + +- Enable EPE User Feedback Module – Select this checkbox to enable integration between an optional + EPE User Feedback module and the Threat Prevention Agent on a domain controller. Click **Update** + to apply the current state of the checkbox to the module. +- Use Custom Messages – Select this checkbox and click **Modify Messages** to open the Custom + Messages Editor window, where you can customize password rejection messages for the EPE User + Feedback module. + +![Custom Messages Editor window](/images/threatprevention/8.1/admin/configuration/custommessageseditor.webp) + +By default, messages are available in the English language. + +- Use the Language drop-down menu to select a language, The Default Message column displays messages + in English while you can edit the Custom Message column to provide the message in the selected + language. +- To edit, double-click a row in the Custom Message column and enter a message. Click **OK** to save + changes or **Cancel** to discard them. Select **Reset** to revert all customized messages back to + defaults. + +The string "{0}" is a placeholder populated at run time with specific values leading to the password +being rejected. The string "{0}" must be included in all custom messages where you want to display +the run time generated information. + +### Rules + +The following windows are global settings for the EPE Password Rules filter within the EPE Settings +window. Whatever is configured in these windows is applied across all EPE Password Rules filter(s) +in the Administration Console. + +![EPE Settings window - Rules area](/images/threatprevention/8.1/admin/configuration/rules.webp) + +You can monitor or block an event with these global settings: + +- Modify Password Dictionary – Requires an exact match between a user entered password and the + password in the dictionary +- Words List of – Global list of character substitutions found in passwords. Uses the Substitution + Editors map to check all permutations of a pending password. +- Substitutions Editor – Create a character substitution map used to create password permutations + for the Words List dictionary + +#### Password Dictionary Window + +The Password Dictionary window is a global setting used across all EPE policies. It contains a +centralized copy of the dictionary.dat file. This modifiable file contains all compromised +passwords. You can add, remove, and modify passwords in the list. + +:::tip +Remember, for the password to be rejected, the user pending password must match exactly to a +password in the Password Dictionary list. +::: + + +Click the **Modify Passwords Dictionary** button in the Rules area on the EPE Settings window. The +Password Dictionary window is displayed. + +![Password Dictionary window](/images/threatprevention/8.1/admin/configuration/passworddictionary.webp) + +The buttons on the right have the following functions: + +- Add From File – Uploads passwords (one password per line) from a TXT file +- Save To File – Opens a Save As window to save the current configuration to a TXTt file at a + desired location +- Sort and Distinct – Automatically removes duplicates and sorts passwords in alphanumeric order +- Find – Use the textbox to search for a password +- Default List – Resets the password values to the original list provided during installation. Any + modifications are discarded. +- Remove All – Deletes all passwords from the window + +Click **OK** to push modifications to all active Threat Prevention Agents. Inactive Agents get the +updated list when they reconnect to the Enterprise Manager. Select **Cancel** to close the window to +discard your changes. + +#### Words List Dictionary Window + +The Words List Dictionary window is a global setting used across all EPE policies. It contains a +user provided global list of character substitutions found in passwords. This feature uses the +entries in the Substitutions Editor to check all permutations of a user entered password. If the +password matches a substitution rule, it is blocked. + +Click the **Modify List of Words for Character Substitution** button in the Rules area on the EPE +Settings window. The Words List Dictionary window is displayed. + +![Words List Dictionary window](/images/threatprevention/8.1/admin/configuration/wordslistdictionary.webp) + +You can add, remove, and modify passwords here. The buttons on the right have the following +functions: + +- Add From File – Uploads passwords (one password per line) from a TXT file +- Save To File – Opens a Save As window to save the current configuration to a TXTt file at a + desired location +- Sort and Distinct – Automatically removes duplicates and sorts passwords in alphanumeric order +- Find – Use the textbox to search for a password +- Remove All – Deletes all character substituted passwords from the window + +Click **OK** to push modifications to all active Threat Prevention Agents. Inactive Agents get the +updated list when they reconnect to the Enterprise Manager. Select **Cancel** to close the window to +discard your changes. + +#### Substitutions Editor Window + +The Substitutions Editor window is a global setting used across all EPE policies. Character +substitutions and their associated replacements are stored in this editor as rules (i.e. A = @). The +Words List Dictionary applies these rules when checking all permutations of a user entered password. + +:::note +All entries in the sequence column must be unique. +::: + + +For example: If “Goal” is added to the Word List Dictionary and A=@ and O=0 are added to the +substitutions editor, then the pending passwords of “Go@l” and “G0al” will be blocked. + +Click the Modify Character Substitution Mapping button in the Rules area on the EPE Settings window. +The Substitution Editor window is displayed. + +![Substitution Editor window](/images/threatprevention/8.1/admin/configuration/substitutioneditor.webp) + +The Substitutions Editor has the following options: + +- Import – Imports a full set of the character substitutions from a user specified file +- Export – Saves the current set of character substitutions to a user specified file +- Reset to default – Resets the character substitutions to the original list provided during + installation. Any modifications are discarded. +- Insert – Displays a custom row for the user to enter Sequence and Replacement values + + :::note + The new row is inserted underneath the current highlighted row. + ::: + + +- Delete – Removes a single row from the Substitutions Editor list. Only one row can be deleted at a + time. + +Click **OK** to save the changes and close the window. Click **Cancel** to close the window to +discard any changes made. + +### Download and Configure the Have I Been Pwned Hash List + +If the Administration Console does not have internet access, you can manually download the HIBP +database. + +The Pwned Passwords Downloader is a .NET tool you can use to download all Pwned Passwords hash ranges and save them offline so they can be used without a dependency on the k-anonymity API. Use this tool to get the latest breached hashes from the Have I Been Pwned (HIBP) database. + +See the [Have I Been Pwned](https://haveibeenpwned.com/) website for more information about the HIBP database. + +:::note +The +[Pwned Passwords Downloader](https://github.com/HaveIBeenPwned/PwnedPasswordsDownloader) +is a third party, open source tool, created by the HaveIBeenPwned team and distributed under a BSD +3-Clause License. You might experience issues during the hash download process, depending on your +threading settings or the load on the CloudFlare backend. The Pwned Passwords Downloader tool will +automatically retry to continue downloading the hashes until it fully completes the download +process. +::: + + +**Prerequisites** + +The Pwned Passwords Downloader has the following prerequisite: + +- Install .NET 6 before installing the + [Pwned Passwords Downloader](https://github.com/HaveIBeenPwned/PwnedPasswordsDownloader) tool. You + can download .NET 6 from Microsoft: + [https://dotnet.microsoft.com/en-us/download/dotnet/6.0](https://dotnet.microsoft.com/en-us/download/dotnet/6.0) + +The Have I Been Pwned database (HIBP) hashes can take up to 30 GB. Make sure that you have enough +free space on your disk. + +**Install the Pwned Passwords Downloader** + +Follow the steps to install the Pwned Passwords Downloader. + +**Step 1 –** Open command prompt, and navigate to your .NET install folder (for example, +`C:\Program Files (x86)\dotnet`). + +**Step 2 –** Run the following command: + +``` +dotnet tool install --global haveibeenpwned-downloader +``` + +![hibp_installation_0](/images/threatprevention/8.1/admin/configuration/hibp_installation_0.webp) + +**Step 3 –** Close the command prompt. + +**Update an Installed Pwned Passwords Downloader** + +Follow the steps to update an installed Pwned Passwords Downloader. + +**Step 1 –** Open the command prompt. + +**Step 2 –** Run the following command: + +``` +dotnet tool update --global haveibeenpwned-downloader +``` + +![hibp_installation_1](/images/threatprevention/8.1/admin/configuration/hibp_installation_1.webp) + +**Download NTLM Hashes with the Pwned Passwords Downloader** + +Follow the steps to download NTLM hashes. + +**Step 1 –** Navigate to the folder where you want to download the hashes. + +**Step 2 –** Download all NTLM hashes to a single txt file, called for example +`pwnedpasswords_ntlm.txt`. + +Run the following command: + +``` +haveibeenpwned-downloader.exe -n pwnedpasswords_ntlm +``` + +![hibp_installation_3](/images/threatprevention/8.1/admin/configuration/hibp_installation_3.webp) +This screenshot shows the completed download. + + +**Step 3 –** To overwrite an existing hash list, run the following command: + +``` +haveibeenpwned-downloader.exe -n pwnedpasswords_ntlm -o +``` + +For a complete list of available parameters, please check the +[Pwned Passwords Downloader GitHub page](https://github.com/HaveIBeenPwned/PwnedPasswordsDownloader). diff --git a/docs/threatprevention/8.1/admin/configuration/eventfilteringconfiguration.md b/docs/threatprevention/8.1/admin/configuration/eventfilteringconfiguration.md new file mode 100644 index 0000000000..5120241ec4 --- /dev/null +++ b/docs/threatprevention/8.1/admin/configuration/eventfilteringconfiguration.md @@ -0,0 +1,190 @@ +--- +title: "Event Filtering Configuration Window" +description: "Event Filtering Configuration Window" +sidebar_position: 50 +--- + +# Event Filtering Configuration Window + +The Event Filtering Configuration window enables you to exclude specific Active Directory and +Authentication events from being monitored. A latency threshold can be set to generate alerts for AD +events. + +:::note +This window is only available to Threat Prevention administrators. +::: + + +Follow the steps to enable event filtering. + +**Step 1 –** Click **Configuration** > **Event Filtering** on the menu to open the Event Filtering +Configuration window. + +![Event Filtering Configuration Window](/images/threatprevention/8.1/admin/configuration/eventfiltering.webp) + +**Step 2 –** The filter options are grouped by AD Global Pre Filters, Authentication Global Pre +Filters, and Alerts. Check the checkboxes to activate the filters and click **Save**. + +To disable a filter for diagnostic purposes, simply uncheck its checkbox and click **Save**. + +Click the Help icon (?) for an option in the AD Global Pre Filters area to view the type of “noise” +events being filtered. + +:::note +All Authentication Global Pre Filters options require configuration before they can be +enabled. +::: + + +:::info +Enable all the AD Global Pre Filters options as well as the Exclude Logins from +Machine Accounts option in the Authentication Global Pre Filters section. +::: + + +When activated, the Agent filters out the event data according to configurations defined in the +filters.json file located in the installation directory of the Enterprise Manager. + +## Exclude ‘Noise’ Events Option + +The Exclude ‘Noise’ Events option is enabled by default to filter out login and internal low level +attributes that can be considered ‘noise’ events, resulting in a bloating of the database. This +option can be scoped to include any combination of the following ‘noise’ events: + +- Successful AD User Logins – Excludes events with the following attributes where ‘objectClass’ does + not equal computer: + - logonCount + - lastLogon + - badPwdCount + - lastLogonTimestamp +- AD User Logins with Bad Password – Excludes events with the following set of attributes where + ‘objectClass’ does not equal computer: + - badPwdCount + - badPasswordTime +- AD Computer Logins – Excludes events with the following set of attributes where ‘objectClass’ + equals computer: + - logonCount + - lastLogon + - badPwdCount + - lastLogonTimestamp + - badPasswordTime + - badPwdCount +- Low Level Attributes – Excludes the following attributes from event: + - ImPwdHistory + - dBCSPwd + - ntPwdHistory + +## Exclude AD DNS Events Option + +The Exclude AD DNS Events option is enabled by default to filter out DNS events. These events can +result in a bloating of the database. They must meet both of the following conditions to be +excluded: + +- objectClass = ‘dnsNode’ or ‘dnsZone’ +- Contains the ‘dnsRecord’ or ‘dNSTombstoned’ attribute + +When the Exclude AD DNS Events checkbox is unchecked, DNS record events are displayed in a +human-readable format on the Recent Events tab of the Active Directory policy. In order to search +these results, the Affected Object: Class can be set to equals dnsNode for the dnsRecord attribute +to display. + +## Do Not Ignore Events With Unchanged Attributes + +The Do Not Ignore Events With Unchanged Attributes option is disabled by default to filter out events where an attribute’s old value is equal to its new value. + +## Exclude Logins from Machine Accounts Option + +The Exclude Logins from Machine Accounts option is enabled by default to filter out machine logins. +These events can result in a bloating of the database. Click the **configure** link to open the Edit +Collection window. + +![Edit Collection window - For Machine Accounts](/images/threatprevention/8.1/admin/configuration/editcollectionmachineaccounts.webp) + +The Exclude Logins from Machine Accounts collection is only accessible through the Event Filtering +Configuration window. Either use the **Add** (+) button to open the +[Select Active Directory Perpetrators Window](/docs/threatprevention/8.1/admin/policies/configuration/eventtype/window/perpetrators.md) +to browse for machine accounts or type the account name in the textbox. + +Only perpetrators with accounts ending in “$” are considered for this filter. Wild cards (\*) can be +used for partial matches to account names. + +All machine accounts in the textbox are either included or excluded from event data monitoring by +the Agent. Machine accounts not in the list have the unselected property applied. + +Select one of the following radio buttons to apply to the list of account names: + +- Pass to agent on match – Included and passed to the Agent for event data monitoring. Machine + accounts not in the list are excluded and ignored by the Agent. +- Remove on match – Excluded and ignored by the Agent. Machine accounts not in the list are included + and sent to the Agent for event data monitoring. + +Repeat the process until all machine accounts to be included or excluded from Authentication event +data have been entered in the list. Then click **OK**. + +**Usage Tip** + +Windows Server 2012 introduced gMSA (Group Managed Service Accounts). gMSA accounts include +“$” in their names, so by default Threat Prevention filters out authentication traffic generated by these accounts because they ‘look’ like machine accounts which prior to Server 2012 were the only account names ending in “$”. +The ability in Threat Prevention to add a list of filter strings to the “Exclude Logins from Machine +Accounts” global filter enables you to capture activity by gMSA type accounts as this activity is +typically of interest whereas true ‘machine accounts’ is not. By supplying either an explicit list +of gMSA account names, or if a naming convention has been adopted, a set of wild card strings such +as “gMSA\*” or “svc\*”, allows capturing authentication activity from such accounts while ignoring +the noisy ‘machine accounts’. + +## Exclude Authentication Events from Selected Hosts Option + +The Exclude Authentication Events from Selected Hosts option is disabled by default as it requires +configuration before it can be enabled. Click the **selected hosts** link to open the Edit +Collection window. + +![Edit Collection window - For Hosts](/images/threatprevention/8.1/admin/configuration/editcollectionhosts.webp) + +The Exclude Authentication Events from Hosts collection is only accessible through the Event +Filtering Configuration window. All three methods of identification for a host (IP address, NETBIOS +host name, or DNS host name) must be known in order to effectively exclude authentication from the +host. Identify the host to be excluded in the textbox under the IP Address column and hit **Enter** +or select the next row in the grid. Threat Prevention attempts to discover the NETBIOS host name and +the DNS host name associated with the supplied IP address. If the host identification is not +resolved or is inaccurate, manually type the information. + +Repeat the process until all hosts for which authentication event data will not be collected have +been entered in the list. Then click **OK**. The Edit Collection window closes, and the Exclude +Authentication Events from selected hosts option can be enabled. + +## Exclude Authentication Events from Selected Accounts Option + +The Exclude Authentication Events from Selected Accounts option is disabled by default as it +requires configuration before it can be enabled. Click the selected accounts link to open the Edit +Collection window. + +![Edit Collection window - For Selected Accounts](/images/threatprevention/8.1/admin/configuration/editcollectionaccounts_1.webp) + +The Exclude Authentication Events from Selected Accounts collection is only accessible through the +Event Filtering Configuration window. Use the **Add** (+) button to open the +[Select Active Directory Perpetrators Window](/docs/threatprevention/8.1/admin/policies/configuration/eventtype/window/perpetrators.md) +to browse for the desired accounts. Account names [domain name\account] can also be typed in the +textbox. Wild cards (\*) can be used as part of either the domain name or account. An asterisk (\*) +appearing anywhere other than as the first character or the last character are treated as a literal +character instead of as a wild card. For example: \*\Service1 would exclude all Service1 accounts +whether it is a domain or local account, and Example\Service\* would exclude all accounts that start +with “Service” for the Example domain. + +Repeat the process until all accounts to be excluded from Authentication event data have been +entered in the list. Then click OK. The Edit Collection window closes, and the Exclude +Authentication Events from selected accounts option can be enabled. + +## AD Events Latency Threshold Option + +The Send Latency Alerts option is disabled by default. It is used to generate alerts if the time +delay between when the Agent detects an AD event and the time the Enterprise Manager receives it +exceeds the specified latency threshold. This option is helpful for troubleshooting when +experiencing slow connection in the environment. These events can result in a bloating of the +database especially if the latency threshold is set too low. + +Select the Send Latency Alerts checkbox to enable this option. Use the arrows, or type into the +textbox, to set the latency threshold in minutes for the time when the Agent detects the event and +the Enterprise Manager receives it. When events exceed the timeframe, alerts are displayed in the +[Alerts Interface](/docs/threatprevention/8.1/admin/alerts/overview.md). Email or SIEM alerts can be generated by selecting the +Agent Latency checkbox in the Operations tab of the +[System Alerting Window](/docs/threatprevention/8.1/admin/configuration/systemalerting/overview.md). diff --git a/docs/threatprevention/8.1/admin/configuration/eventsdatabaseconfiguration.md b/docs/threatprevention/8.1/admin/configuration/eventsdatabaseconfiguration.md new file mode 100644 index 0000000000..fd5ab38570 --- /dev/null +++ b/docs/threatprevention/8.1/admin/configuration/eventsdatabaseconfiguration.md @@ -0,0 +1,22 @@ +--- +title: "Events Database Configuration Window" +description: "Events Database Configuration Window" +sidebar_position: 40 +--- + +# Events Database Configuration Window + +The Events Database Configuration window manages the NVMonitorData database, also known as the +Events database. Click **Configuration** > **Database** > **Server** on the menu to open it. + +This window is only available to Threat Prevention administrators. + +![Events Database Configuration Window](/images/threatprevention/8.1/admin/configuration/eventsdatabaseconfig.webp) + +The Event database is originally configured when installing the Threat Prevention Enterprise Manager +package. See the [Application Server Install](/docs/threatprevention/8.1/install/application.md) topic for additional +information. This window displays the current connection settings for the Event database. + +Credentials and/or SQL Server host information can be changed in the DB Connection Manager +application. See the [DB Connection Manager Wizard](/docs/threatprevention/8.1/install/dbconnectionmanager.md) topic for +additional information. diff --git a/docs/threatprevention/8.1/admin/configuration/filemonitorsettings.md b/docs/threatprevention/8.1/admin/configuration/filemonitorsettings.md new file mode 100644 index 0000000000..c93bc7c8bc --- /dev/null +++ b/docs/threatprevention/8.1/admin/configuration/filemonitorsettings.md @@ -0,0 +1,103 @@ +--- +title: "File Monitor Settings Window" +description: "File Monitor Settings Window" +sidebar_position: 60 +--- + +# File Monitor Settings Window + +The File Monitor Settings window provides global settings for managing log retention, the ability to +disable office file filtering, inherited permissions for parent object changes, and AD accounts and +file system activity processes for Threat Prevention file monitoring and blocking policies. + +Follow the steps to configure file system monitoring. + +**Step 1 –** Click **Configuration** > **File Monitor Settings** on the menu; the File Monitor +Settings window opens. This window is only available to Threat Prevention administrators. + +![File Monitor Settings window](/images/threatprevention/8.1/admin/configuration/filemonitorsettings.webp) + +**Step 2 –** Enable or disable the following options: + +- Logs retention period, days – Log retention period for activity logs (TSV files) created by the + Threat Prevention Agent for Windows servers or by the Activity Monitor Agent for NAS devices and + then read by the Threat Prevention Agent. This does not affect File System Access Analyzer event + types. + The Threat Prevention Agent reads logs in real time and retains the original logs for a set number + of days before the logs are automatically deleted. This setting configures the log retention + period for all enabled policies using the File System Changes and/or File System Lockdown event + types. By default, it is set to 10 days. +- Microsoft Office temporary files filtering – Global setting that is checked by default. If + checked, the temporary files associated with Microsoft office operations, such as copy, paste, + etc., are not monitored. When unchecked, all the temporary files associated with Microsoft office + operations are monitored. +- FS inherited permissions filtering – Reports separate events for the parent object and each child + object. When checked, it reports an event only for the parent object. +- Exclude selected accounts – When checked, the user-supplied list of AD user and group names as + well as well-known SIDs for built-in users/groups are excluded from file system monitoring and + blocking policies at the global level. See the Select Local Processes to Exclude topic to specify + accounts. +- Exclude selected processes – When checked, the user-supplied list of processes are excluded from + the file system monitoring and blocking policies at the global level. See the Select Local + Processes to Exclude topic to specify processes. +- Include Folder read / list operations – When checked, all list/read folder operations are included + in the reporting for file system monitoring and blocking at the global level. +- Ignore SYSTEM account for NTDS.DIT file – When checked, access to the .dit file by the SYSTEM + account will not be reported by a File System monitoring policy and not be blocked in the case of + a File System blocking policy. Backup programs often use the SYSTEM account to access the .dit + file and you may not want to report on or block such activity. + +**Step 3 –** Click **Update** to save your changes. + +## Select Accounts to Exclude from Collections + +A collection is a list of SIDs for built-in users/groups that is excluded for all File System +activity. You can add more accounts to this collection. + +Follow the steps to populate the collection with accounts to be excluded from File System +monitoring. + +**Step 1 –** Click **Configuration** > **File Monitor Settings** on the menu to launch the File +Monitor Settings window. + +**Step 2 –** Check the **Exclude selected accounts** checkbox and then click **accounts**. The Edit +Collection window opens. + +![File Monitor Settings > Edit Collection window (for accounts)](/images/threatprevention/8.1/admin/configuration/editcollectionaccounts.webp) + +**Step 3 –** Use the **Add** (+) button to open the +[Select Active Directory Perpetrators Window](/docs/threatprevention/8.1/admin/policies/configuration/eventtype/window/perpetrators.md) +to browse for and select AD accounts. + +**Step 4 –** Click **OK** to save your changes. + +**Step 5 –** Click **Update** on the File Monitor Settings window. + +Any accounts added to the list are excluded globally from File System activity. + +:::note +If the **Exclude selected processes** option is checked, any file activity generated by +the processes added will have their File System activity ignored. +::: + + +## Select Local Processes to Exclude + +Follow the steps to select local processes for exclusion from File System activity. + +**Step 1 –** Click **Configuration** > **File Monitor Settings** on the menu to launch the File +Monitor Settings window. + +**Step 2 –** Check the **Exclude selected processes** checkbox and then click **processes**. The +Edit Collection window opens. + +![File Monitor Settings > Edit Collection window (for processes)](/images/threatprevention/8.1/admin/configuration/editcollectionprocesses.webp) + +**Step 3 –** Use the Items textbox to enter process names. You must enter a process name exactly as +is; for example, as it appears on the Details tab of Windows Task Manager. + +**Step 4 –** Click **OK** to save your changes. + +**Step 5 –** Click **Update** on the File Monitor Settings window. + +Any processes added to the list will not have their File System activity reported. diff --git a/docs/threatprevention/8.1/admin/configuration/siemoutputviewer.md b/docs/threatprevention/8.1/admin/configuration/siemoutputviewer.md new file mode 100644 index 0000000000..aa1a9b9646 --- /dev/null +++ b/docs/threatprevention/8.1/admin/configuration/siemoutputviewer.md @@ -0,0 +1,85 @@ +--- +title: "SIEM Output Viewer" +description: "SIEM Output Viewer" +sidebar_position: 70 +--- + +# SIEM Output Viewer + +The SIEM Output Viewer window displays the event data (messages) that Threat Prevention writes to +syslog (SIEM) in real time. + +- Event data generated for a policy is sent to SIEM if the 'Send to SIEM' option is selected for + that policy on the Actions tab. See the + [Send to SIEM](/docs/threatprevention/8.1/admin/policies/configuration/actions/overview.md#send-to-siem) topic for additional information. +- Event data generated for an analytic is sent to SIEM if the 'Send Raw Data to SIEM' option is + selected for that analytic on the Actions tab. See the + [Send to SIEM](/docs/threatprevention/8.1/admin/policies/configuration/actions/overview.md#send-to-siem) topic for additional information. +- Event data generated for an event/incident/policy is sent to SIEM if a SIEM profile has been + assigned to it on the [SIEM Tab](/docs/threatprevention/8.1/admin/configuration/systemalerting/siem.md) of the System Alerting Window. + +While you can also use third-party tools like +[Kiwi Syslog Server](https://www.solarwinds.com/free-tools/kiwi-free-syslog-server) to view the +output, the SIEM Output Viewer window may serve as a troubleshooting tool to view and verify the +actual data Threat Prevention sends to syslog (SIEM) in real time. + +Follow the steps to view real time data (messages) that Threat Prevention sends to SIEM. + +**Step 1 –** Click **Configuration** > **SIEM Output Viewer** on the menu; the SIEM Output Viewer +window opens. This window is only available to Threat Prevention administrators. + +![SIEM Output Viewer window](/images/threatprevention/8.1/admin/configuration/siemoutputviewer.webp) + +**Step 2 –** Click **Start**. As events occur and Threat Prevention writes to syslog (sends +event/policy/analytics data to SIEM) in real time, they are displayed on the window. + +**Step 3 –** The **Autoscroll** checkbox enables or disables automatic scrolling of the log display. + +- When enabled, the SIEM Output Viewer window automatically scrolls down to show the latest incoming + messages in real time. +- When disabled, you will have to manually scroll and review log entries without the display + automatically jumping to the newest message. + +**Step 4 –** For each message, the following is displayed: + +- Event: Time Logged – Timestamp for when the event was monitored/blocked. The specified time is the + local time for the server where the Agent is deployed.Hover over the data in this column to view + the local time (of the Enterprise Manager) and UTC time simultaneously. +- Host – The IP address or name of the SIEM server, configured in the SIEM server settings +- Port – The port number to communicate with the SIEM server, configured in the SIEM server settings +- Protocol – The protocol set when configuring the SIEM server, i.e., TCP or UDP +- SSL – Shows whether SSL is used when sending data to SIEM (applies if TCP is set as the protocol) +- Message – The actual data sent to syslog +- Status – This field is empty if the message is successfully sent. Otherwise, it will contain the + text of the received error, for example, 'Connection timeout' + +You can select a row and use Ctrl+C to copy the data displayed in it. Then paste it to another +application like Notepad to examine it in detail. + +:::note +The host, port, protocol, and SSL columns display the settings configured for the SIEM +server where the respective message is sent. See the +[Configure a SIEM Server ](/docs/threatprevention/8.1/admin/configuration/systemalerting/siem.md#configure-a-siem-server) topic for additional +information. +::: + + +This data grid employs features for sorting, filtering, searching, and more. + +- Right-click anywhere in the column header to get a menu with several options to sort the data in + the grid. See the + [Data Grid Right-Click Menu](/docs/threatprevention/8.1/admin/navigation/rightclickmenus.md#data-grid-right-click-menu) topic + for additional information. +- The Group by Box ribbon just above the header row impacts how much data is displayed. See the + [Sort Data](/docs/threatprevention/8.1/admin/navigation/datagrid.md#sort-data) topic for additional information. +- Columns can be reordered as desired as well as removed from the data grid. Removed columns can be + added back through the [Customization Window](/docs/threatprevention/8.1/admin/navigation/datagrid.md#customization-window). +- The Search icon opens the **Enter text to search…** textbox where you can search for the required + data in the data grid. See the [Search Data](/docs/threatprevention/8.1/admin/navigation/datagrid.md#search-data) topic for + additional information. + +**Step 5 –** Click **Save** to save the displayed data to a text file or **Clear** to clear the +data. + +On clicking **Save**, the Safe As dialog box is displayed, where you can select a location to save +the text file. diff --git a/docs/threatprevention/8.1/admin/configuration/systemalerting/_category_.json b/docs/threatprevention/8.1/admin/configuration/systemalerting/_category_.json new file mode 100644 index 0000000000..4e8e958d45 --- /dev/null +++ b/docs/threatprevention/8.1/admin/configuration/systemalerting/_category_.json @@ -0,0 +1,10 @@ +{ + "label": "System Alerting Window", + "position": 100, + "collapsed": true, + "collapsible": true, + "link": { + "type": "doc", + "id": "overview" + } +} \ No newline at end of file diff --git a/docs/threatprevention/8.1/admin/configuration/systemalerting/email.md b/docs/threatprevention/8.1/admin/configuration/systemalerting/email.md new file mode 100644 index 0000000000..35439803cd --- /dev/null +++ b/docs/threatprevention/8.1/admin/configuration/systemalerting/email.md @@ -0,0 +1,210 @@ +--- +title: "Email Tab" +description: "Email Tab" +sidebar_position: 10 +--- + +# Email Tab + +Alert notification via email sends messages through an SMTP gateway. Alerts are designed to send +email notifications to individuals or groups. + +Follow the steps to configure the Email tab of the System Alerting window. + +**Step 1 –** Click **Configuration** > **Alerts** on the menu. The Netwrix Threat Prevention System +Alerting window opens. The Email tab is displayed by default. + +![Netwrix Threat Prevention System Alerting window](/images/threatprevention/8.1/admin/configuration/systemalerting/systemalerting.webp) + +**Step 2 –** Configure the following prior to enabling email alerting: + +- Configure SMTP Host Information +- Create Message Profiles + +**Step 3 –** Once configured, click **Events** on the **Email** tab. Decide what events receive +notifications and assign one or more message profiles to the event. + +**Step 4 –** Click the button next to Disabled to toggle the setting to **Enabled**. + +**Step 5 –** Select an event category (Security, Operations, Configuration, Analytics, Policies) in +the left pane. + +**Step 6 –** Check the checkbox for the event/incident/policy for which you want to trigger email +notifications. + +**Step 7 –** Click the **Select Profile, please** option for an event/incident/policy and select a +Message Profile from the drop-down menu to assign it to the event/incident/policy. When an alert is +generated for the event/incident/policy, an email will be sent to all recipients specified in the +Message Profile. + +- For policies, multiple profiles can be assigned by either checking the desired profile(s) or the + Select All option. Click **OK** in the drop-down menu to confirm the selection. + +You can assign a profile to as many events as required. + +**Step 8 –** For the Security, Operations, and Configuration event categories, the Suppression time +option is also available for each event. Use it to prevent Threat Prevention from generating alerts +for an event for a specified time period. This limits the volume of repeat alerts for the respective +event. + +Click **Suppression time** for an event and select an option from the drop-down menu: + +- A duration ( 1 min, 2 min, 5 min, 10 min, 30 min, 60 min) – Once an alert is generated for the + event, Threat Prevention will not generate another alert for it during the next X minutes (X is + the duration you selected) even if the event occurs. +- Disabled – Alerts will not be suppressed + +**Example** + +You select a suppression time of 30 minutes for an event. Next, an alert is generated for that +event. If the event occurs again within the next 30 minutes, an alert will not be generated. + +The suppression time feature enables you to tackle situations where numerous alerts are generated +for an event, such as Agent Latency, causing the Enterprise Manager and Administration Console to +freeze. + +**Step 9 –** For Analytics, choose whether or not to enable Ongoing Attack Alerts. When checked, +Threat Prevention sends periodic reminders of an ongoing attack if it continues after the initial +notification has been sent. + +**Step 10 –** Click **OK** to save the settings. + +Threat Prevention now sends email notifications for the selected events/incident/policies to the +recipients of the selected Message Profiles. + +### Configure SMTP Host Information + +Follow the steps to configure the SMTP host information for email alerting. + +:::tip +Remember, this is a one-time setting to enable email alerts from the Administration Console. +::: + + +![System Alerting window - Email tab - Configure SMTP Host and Message Profile](/images/threatprevention/8.1/admin/configuration/systemalerting/smtphost.webp) + +**Step 1 –** Click **Configuration** > **Alerts** on the menu. The Netwrix Threat Prevention System +Alerting window opens. + +**Step 2 –** On the Email tab, click **Configure**. + +**Step 3 –** In the Server section, provide the SMTP Host as either the IP address or the hostname +of the SMTP gateway. Example: 192.168.189.56 or SIM1.netwrix.com + +**Step 4 –** In the **Port** box, provide the appropriate port number. + +**Step 5 –** Check the **Enable SSL** checkbox to use SSL communications for email. + +**Step 6 –** In the **From** box, enter the email address to be used as the sender for the email. +Example: Threat Prevention@Netwrix.com + +**Step 7 –** If the SMTP gateway requires authentication, check the **Requires Authentication** +checkbox and provide a username and password in the boxes that appear. + +**Step 8 –** Click **OK** to save the settings. + +### Create Message Profiles + +Message Profiles are associated with events for email alerting. Follow the steps to create a Message +Profile. + +:::note +When the Message Profile is modified for an alert, all policies referencing the alert use +the updated information. +::: + + +![System Alerting window - Email tab - Configure SMTP Host and Message Profile](/images/threatprevention/8.1/admin/configuration/systemalerting/smtphost.webp) + +**Step 1 –** Click **Configuration** > **Alerts** on the menu. The Netwrix Threat Prevention System +Alerting window opens. + +**Step 2 –** On the Email tab, click **Configure**. + +**Step 3 –** In the Message Profiles area, click the **Add** (+) button to create a Message Profile. +The default profile name (New Email Notification) is displayed. + +:::info +Provide a unique and descriptive name for this new email notification profile. +::: + + +**Step 4 –** Choose between **Plain Text** and **HTML** email options. The Email Template window +displays when selecting either radio button. + +![Email Template window](/images/threatprevention/8.1/admin/configuration/systemalerting/emailtemplate.webp) + +Changing the message template provides the option to load the default message template. Choose +between: + +- Yes – Loads the default message template for the selected format. This overwrites the current + message template. +- No – Leads the current message body + +**Step 5 –** In the To box, provide an email address for each recipient of the email alert. This can +be individuals, distribution lists, or a combination. To send alerts to multiple recipients, +separate the addresses with either a comma (,) or a semi-colon (;). Example: IT@netwrix.com; +ITdl@netwrix.com + +**Step 6 –** Click the Send Test Email link to send a test email. It sends an unformatted sample +message to all recipients. Threat Prevention informs you if the message is successfully sent, but is +not able to tell if it was received. + +**Step 7 –** In the Subject box, keep the default subject line for the email or provide one that is +more suitable for the alerts these recipients receive. + +**Step 8 –** The Body box contains the default message, which includes all event data types +available for notification. To customize it for the specific alerts, simply remove the Event Data +Fields not desired. Customization can also include reformatting the message as desired. The default +message is: + +- Plain Text – An event has occurred in which you are on the notification list. +- HTML – The following Event has occurred at %TIME_STAMP% for which you requested notification + +The available Event Data Fields and their associated tokens are: + +| Event Data Field | Token | +| ---------------------------- | ------------------------------ | +| Time Stamp | %TIME_STAMP% | +| Event Source Type | %EVENT_SOURCE_TYPE% | +| Domain Name | %EVENT_SOURCE_NAME% | +| Policy Name | %SETTING_NAME% | +| Event Name | %EVENT_NAME% | +| Event Name Translated | %EVENTNAMETRANSLATED% | +| Originating Server | % ORIGINATING_SERVER% | +| Originating Server IP | %ORIGINATING_SERVERIP% | +| Target Host | %TARGETHOST% | +| Target Host IP | %TARGETHOSTIP% | +| Class Name | %CLASS_NAME% | +| DN | %DN% | +| Affected Object SID | %AFFECTED_OBJECT_SID% | +| Affected Object Account Name | %AFFECTED_OBJECT_ACCOUNT_NAME% | +| Operation Successful | %SUCCESS% | +| Operation Status | %STATUS% | +| Blocked Event | %BLOCKED_EVENT% | +| Perpetrator | %PERPETRATOR% | +| Perpetrator Name | %PERPETRATOR_NAME% | +| Perpetrator Sid | %PERPETRATOR_SID% | +| Originating Client | %ORIGINATING_CLIENT% | +| Originating Client Host | %ORIGINATINGCLIENTHOST% | +| Originating Client IP | %ORIGINATINGCLIENTIP% | +| Originating Client Protocol | %ORIGINATINGCLIENTPROTOCOL% | +| Originating Client MAC | %ORIGINATINGCLIENTMAC% | +| Events Count | %EVENTS_COUNT% | +| Attribute Values | %ATTRIBUTE_VALUE% | +| Old Attribute Values | %OLD_ATTRIBUTE_VALUE% | +| Attribute Operations | %OPERATION% | + +:::warning +The tokens used within the message Body, the information between and including the % +symbols (e.g. %TIME_STAMP%), must be present to retrieve that event data from the database. Tokens +can be removed, but partial tokens do not retrieve data from the database. +::: + + +**Step 9 –** Click **OK** to save the settings. + +Now that at least one Message Profile has been created, it can be assigned to an event either +through the System Altering window’s Email tab or assigned to a policy on the +[Actions Tab](/docs/threatprevention/8.1/admin/policies/configuration/actions/overview.md) of the policy configuration or the +[Actions Tab](/docs/threatprevention/8.1/admin/templates/configuration/actions.md) of the template configuration. diff --git a/docs/threatprevention/8.1/admin/configuration/systemalerting/eventlog.md b/docs/threatprevention/8.1/admin/configuration/systemalerting/eventlog.md new file mode 100644 index 0000000000..f383cf9a1e --- /dev/null +++ b/docs/threatprevention/8.1/admin/configuration/systemalerting/eventlog.md @@ -0,0 +1,49 @@ +--- +title: "Event Log Tab" +description: "Event Log Tab" +sidebar_position: 20 +--- + +# Event Log Tab + +Alert notification via Event Log sends event notifications to the Windows Event Log. Follow the +steps to enable Event Log alerting. + +![System Alerting window – Event Log tab](/images/threatprevention/8.1/admin/configuration/systemalerting/eventlog.webp) + +**Step 1 –** Click **Configuration** > **Alerts** on the menu. The Netwrix Threat Prevention System +Alerting window opens. + +**Step 2 –** Click the **Event Log** tag. + +**Step 3 –** Click the button next to Disabled to toggle the setting to **Enabled**. + +**Step 4 –** Select an event category (Security, Operations, Configuration) in the left pane. + +**Step 5 –** Check the checkboxes for the event(s) for which you want to trigger Windows Event Log +notifications. + +**Step 6 –** For the Security, Operations, and Configuration event categories, the Suppression time +option is also available for each event. Use it to prevent Threat Prevention from generating alerts +for an event for a specified time period. This limits the volume of repeat alerts for the respective +event. + +Click **Suppression time** for an event and select an option from the drop-down menu: + +- A duration ( 1 min, 2 min, 5 min, 10 min, 30 min, 60 min) – Once an alert is generated for the + event, Threat Prevention will not generate another alert for it during the next X minutes (X is + the duration you selected) even if the event occurs. +- Disabled – Alerts will not be suppressed + +**Example** + +You select a suppression time of 30 minutes for an event. Next, an alert is generated for that +event. If the event occurs again within the next 30 minutes, an alert will not be generated. + +The suppression time feature enables you to tackle situations where numerous alerts are generated +for an event, such as Agent Latency, causing the Enterprise Manager and Administration Console to +freeze. + +**Step 7 –** Click **OK** to save the settings. + +The Windows Event Log now receives alert notifications for the checked events. diff --git a/docs/threatprevention/8.1/admin/configuration/systemalerting/overview.md b/docs/threatprevention/8.1/admin/configuration/systemalerting/overview.md new file mode 100644 index 0000000000..3017f6589f --- /dev/null +++ b/docs/threatprevention/8.1/admin/configuration/systemalerting/overview.md @@ -0,0 +1,97 @@ +--- +title: "System Alerting Window" +description: "System Alerting Window" +sidebar_position: 100 +--- + +# System Alerting Window + +The System Alerting window is only available to administrators, enabling them to configure and +manage all alerting avenues. Click **Configuration** > **Alerts** on the menu to open it. + +![Netwrix Threat Prevention System Alerting window](/images/threatprevention/8.1/admin/configuration/systemalerting/systemalerting.webp) + +Alerts can be sent to recipients via email, to Windows Event Log, and to SIEM products. Alerts are +grouped into five types: + +- Security – Provides alerts on things that impact: + + - What data is collected + - The ability to collect the data + - Changes to who can access it + +- Operations – Provides alerts on internal operations of the product that are not directly + influenced by a user +- Configuration – Provides alerts on changes to general configuration settings +- Analytics – Provides alerts when an analytic incident is triggered. These alerts are not available + for Event Log alerts. +- Policies – Provides alerts when a policy monitors or blocks an event. These alerts are not + available for Event Log alerts. + +## Email and SIEM Alert Notifications for Policy Events + +Email and SIEM alert notifications for policy events can be enabled through: + +- The System Alerting window +- The [Actions Tab](/docs/threatprevention/8.1/admin/policies/configuration/actions/overview.md) of a policy +- The [Actions Tab](/docs/threatprevention/8.1/admin/templates/configuration/actions.md) of a policy template + +In any case, configuration must first be set through the System Alerting window. The +[Alerts Interface](/docs/threatprevention/8.1/admin/alerts/overview.md) allows you to quickly view recent alerts in a +centralized location. + +## Email and SIEM Alert Notifications for Analytic Incidents + +Email and SIEM alert notifications for Analytic incidents can be configured through the System +Alerting window to send Ongoing Attack Alerts. In this case, Threat Prevention sends periodic +reminders of an ongoing attack if it continues after the initial notification has been sent. + +## View the Alert Notifications + +Notifications are generated for the alerts you enable on the the System Alerting window. + +- All Security, Configuration, and Operation alert notifications are displayed on the + [Alerts Interface](/docs/threatprevention/8.1/admin/alerts/overview.md). +- All Analytics incidents are displayed on the [Analytics Interface](/docs/threatprevention/8.1/admin/analytics/overview.md). +- All Policies events are displayed on the [Investigate Interface](/docs/threatprevention/8.1/admin/investigate/overview.md). + +## General Considerations + +Below are some considerations: + +- Occasionally a Microsoft Security Bulletin impacting LSASS can interfere with the Agent + instrumentation resulting in LSASS shutting down. The Agent is configured to monitor for an LSASS + process termination shortly after a server reboot. The + [LSASS Process Terminated](/docs/threatprevention/8.1/troubleshooting/lsass.md) alert (Operations alert) is + triggered in this event and the Agent is stopped. As a result, all monitoring/blocking by that + Agent stops. To resolve the issue, either upgrade to the latest version of the Agent or simply + upgrade SI.ActiveDirectoryMonitor.dll - commonly known as ADMonitor DLL (recommended). See the + [Upgrade ADMonitor](/docs/threatprevention/8.1/admin/agents/agent-management/upgradeadmonitor.md)topic for additional information. + + :::info + Activate an email notification for the _LSASS process terminated_ alert. See + the + [Enable the 'LSASS Process Terminated' Email Alert](/docs/threatprevention/8.1/troubleshooting/lsass.md#enable-the-lsass-process-terminated-email-alert) + topic for additional information. + ::: + + +- In addition to the LSASS process termination check, the Agent can be configured for a Safe Mode. + In Safe Mode, the Agent records the version of the LSASS DLLs that it hooks into during + installation. When an Agent is restarted, it compares the DLL versions with the recorded list. If + the versions do not match, the Windows AD Events monitoring module is not loaded. The Agent’s + status in the Agents interface changes to Active (Modules Pending), and all Active Directory + monitoring/blocking by that Agent stops. The 'Agent Started in AD Monitor pending mode' alert + (Operations alert) is triggered in this event. To resolve the issue temporarily, the Threat + Prevention administrator should start the pending modules. See the + [Start Pending Modules](/docs/threatprevention/8.1/admin/agents/agent-management/startpendingmodules.md) topic for additional + information. It is also recommended to upgrade SI.ActiveDirectoryMonitor.dll (commonly known as + ADMonitor DLL) to resolve the issue permanently. See the + [Upgrade ADMonitor](/docs/threatprevention/8.1/admin/agents/agent-management/upgradeadmonitor.md) topic for additional information. + + :::info + Activate an email notification for this alert. See the + [Enable Agent Started in AD Monitor Pending Mode Email Alert](/docs/threatprevention/8.1/admin/agents/safemode.md#enable-agent-started-in-ad-monitor-pending-mode-email-alert) + topic and the [Agent Safe Mode](/docs/threatprevention/8.1/admin/agents/safemode.md) topic for additional information. + + ::: diff --git a/docs/threatprevention/8.1/admin/configuration/systemalerting/siem.md b/docs/threatprevention/8.1/admin/configuration/systemalerting/siem.md new file mode 100644 index 0000000000..6cb5e0c571 --- /dev/null +++ b/docs/threatprevention/8.1/admin/configuration/systemalerting/siem.md @@ -0,0 +1,190 @@ +--- +title: "SIEM Tab" +description: "SIEM Tab" +sidebar_position: 30 +--- + +# SIEM Tab + +Alert notification via SIEM sends event notifications to a SIEM product using UDP or TCP protocol. +Before SIEM alerting can be enabled, the SIEM server must be configured. + +Follow the steps to set up what events receive notifications. + +**Step 1 –** Click **Configuration** > **Alerts** on the menu. The Netwrix Threat Prevention System +Alerting window opens. + +**Step 1 –** Click the **SIEM** tab. + +**Step 2 –** Click **Configure** to configure a SIEM server. See the Configure a SIEM Server topic +for additional information. + +**Step 3 –** Once configured, click **Events** on the **SIEM** tab. + +![Netwrix Threat Prevention System Alerting window - SEIM tab](/images/threatprevention/8.1/admin/configuration/systemalerting/seim.webp) + +**Step 4 –** Click the button next to Disabled to toggle the setting to **Enabled**. + +**Step 5 –** Select an event category (Security, Operations, Configuration, Analytics, Policies) in +the left pane. + +You can set a SIEM mapping file for each type of event category, as discussed in the Configure a +SIEM Server topic. + +**Step 6 –** Check the checkbox for the event/incident/policy for which you want to trigger SIEM +notifications. + +**Step 7 –** Click the **Select Profile, please** drop-down menu for an event/incident/policy and +select a SIEM Profile to assign to it. When an alert is generated for the event/incident/policy, a +notification will be sent to the SIEM server specified in the SIEM Profile. + +- For policies, multiple profiles can be assigned by either checking the desired profile(s) or the + Select All option. Click **OK** in the drop-down menu to confirm the selection. + +You can assign a profile to as many events as required. + +**Step 8 –** For the Security, Operations, and Configuration event categories, the Suppression time +option is also available for each event. Use it to prevent Threat Prevention from generating alerts +for an event for a specified time period. This limits the volume of repeat alerts for the respective +event. + +Click **Suppression time** for an event and select an option from the drop-down menu: + +- A duration ( 1 min, 2 min, 5 min, 10 min, 30 min, 60 min) – Once an alert is generated for the + event, Threat Prevention will not generate another alert for it during the next X minutes (X is + the duration you selected) even if the event occurs. +- Disabled – Alerts will not be suppressed + +**Example** + +You select a suppression time of 30 minutes for an event. Next, an alert is generated for that +event. If the event occurs again within the next 30 minutes, an alert will not be generated. + +The suppression time feature enables you to tackle situations where numerous alerts are generated +for an event, such as Agent Latency, causing the Enterprise Manager and Administration Console to +freeze. + +**Step 9 –** For Analytics, choose whether or not to enable Ongoing Attack Alerts. When checked, +Threat Prevention sends periodic reminders of an ongoing attack if it continues after the initial +notification has been sent. + +**Step 10 –** Click **OK** to save the settings. + +Threat Prevention now sends SIEM notifications for the selected events/incidents/policies to the +SIEM product configured in the assigned SIEM profile. All notifications sent to SIEM are also +displayed on the [SIEM Output Viewer](/docs/threatprevention/8.1/admin/configuration/siemoutputviewer.md) window. + +## Configure a SIEM Server + +Multiple profiles can be created across SIEM servers to serve different alerting functions. Follow +the steps to configure one or more SIEM servers for alerting. + +![Netwrix Threat Prevention System Alerting window – SEIM tab – Configure SEIM Server](/images/threatprevention/8.1/admin/configuration/systemalerting/seimserver.webp) + +**Step 1 –** Click **Configuration** > **Alerts** on the menu. The Netwrix Threat Prevention System +Alerting window opens. + +**Step 1 –** On the SIEM tab, click **Configure**. + +**Step 2 –** In the SIEM Profiles area, click the Add (+) button to create a new SIEM profile. To +rename the default text, select the name string and enter the new profile name. + +:::info +For each profile, use a unique name for easy identification. +::: + + +**Step 3 –** Use the Protocol drop-down menu to select either protocol: + +- UDP +- TCP – If selected, the Require SSL/TLS checkbox is displayed. If desired, check this box and + ensure the certificate is saved in the certificate store. + +**Step 4 –** In the Host Address box, provide either an IP address or server name for the SIEM +server. + +**Step 5 –** In the Port box, provide the port number to communicate with the SIEM server. + +**Step 6 –** Use the Mapping File for Events drop-down menu to select the SIEM product to receive +policy event notifications. The gear icon to the right of the drop-down allows you to import a +custom mapping file. These mapping file formats are specifically designed for policy events. + +**Step 7 –** Use the Mapping File for System Alerts drop-down menu to select the SIEM product to +receive Threat Prevention Security, Threat Prevention Operations, and Threat Prevention +Configuration event alerts. + +The gear icon to the right of the drop-down allows you to import a custom mapping file. These +mapping file formats are specifically designed for Threat Prevention system events. + +**Step 8 –** Use the Mapping File for Authentication Analytics drop-down menu to select the SIEM +product to receive Authentication Analytics incident alerts. + +The gear icon to the right of the drop-down allows you to import a custom mapping file. These +mapping file formats are specifically designed for Analytics incidents. + +**Step 9 –** Use the Mapping File for File Analytics drop-down menu to select the SIEM product to +receive File Analytics incident alerts. + +The gear icon to the right of the drop-down allows you to import a custom mapping file. These +mapping file formats are specifically designed for Analytics incidents. + +**Step 10 –** _(Optional)_ Use the **Test** button to confirm the configuration settings. + +**Step 11 –** Click **OK** to save the settings. + +Once a SIEM server is configured, assign it to events using the System Alerting window’s SIEM Tab or +the [Actions Tab](/docs/threatprevention/8.1/admin/policies/configuration/actions/overview.md) of a policy or the +[Actions Tab](/docs/threatprevention/8.1/admin/templates/configuration/actions.md) of a policy template. + +**IBM QRadar Integration** + +Netwrix has created a custom app for integration between Threat Prevention and QRadar. See the +[Active Directory App for QRadar](/docs/threatprevention/8.1/siemdashboard/qradar/overview.md) topic for additional +information. There is also a custom app for File Activity, that can receive data from either Threat +Prevention or Netwrix Activity Monitor. See the +[Netwrix Activity Monitor Documentation](https://helpcenter.netwrix.com/category/activitymonitor) +for additional information. + +**Splunk Integration** + +Netwrix has created custom apps for integration between Threat Prevention and Splunk. See the +[Active Directory App for Splunk](/docs/threatprevention/8.1/siemdashboard/activedirectory/overview.md) topic +and the [Threat Hunting App for Splunk](/docs/threatprevention/8.1/siemdashboard/threathunting/overview.md) +topic for additional information. There is also a custom app for File Activity, that can receive +data from either Threat Prevention or Netwrix Activity Monitor. See the +[Netwrix Activity Monitor Documentation](https://helpcenter.netwrix.com/category/activitymonitor) +for additional information. + +## Add a Custom SIEM Mapping File + +Custom SIEM mapping files can be added. First create the mapping file, and save it at a location +that the Administration Console can access. The default mapping files are stored in the following +folder: + +**…\Netwrix\Netwrix Threat Prevention\SIWinConsole\SIEMTemplates\** + +Follow the steps to add a custom SIEM mapping file. + +![SIEM tab - Gear icon for Custom Mapping File](/images/threatprevention/8.1/admin/configuration/systemalerting/geariconformappingfile.webp) + +**Step 1 –** Click **Configuration** > **Alerts** on the menu. The Netwrix Threat Prevention System +Alerting window opens. + +**Step 2 –** On the SIEM tab, click **Configure**. + +**Step 3 –** Click the **gear** icon for an alert type to open the SIEM Templates window. The new +mapping file will only be available for the specific type selected. + +![SIEM Templates window](/images/threatprevention/8.1/admin/configuration/systemalerting/siemtemplates.webp) + +**Step 4 –** Click **Add** (+) to open the Import SIEM Mapping File window. + +![Import SIEM Mapping File window](/images/threatprevention/8.1/admin/configuration/systemalerting/importfile.webp) + +**Step 5 –** Select the desired mapping file and click **Open**. The SIEM Mapping File window closes +and the selected mapping file appears in the SIEM Templates window. It is now available in the +drop-down menu. Click **Close**. + +**Step 6 –** Click **OK** to save the settings. + +The new mapping file can now be selected from the drop-down menu for the respective alert type. diff --git a/docs/threatprevention/8.1/admin/configuration/threatmanagerconfiguration.md b/docs/threatprevention/8.1/admin/configuration/threatmanagerconfiguration.md new file mode 100644 index 0000000000..b29464698b --- /dev/null +++ b/docs/threatprevention/8.1/admin/configuration/threatmanagerconfiguration.md @@ -0,0 +1,160 @@ +--- +title: "Netwrix Threat Manager Configuration Window" +description: "Netwrix Threat Manager Configuration Window" +sidebar_position: 80 +--- + +# Netwrix Threat Manager Configuration Window + +The Netwrix Threat Manager Configuration window is a global setting to enable integration between +Threat Prevention and Threat Manager. This window is only available to Threat Prevention +administrators. + +**Threat Manager App Token** + +The Threat Manager App Token authenticates connection between Threat Prevention and Threat Manager. +This token is generated in Threat Manager: + +- In Threat Manager, navigate to the **Configuration** > **App Tokens** page. +- Generate a new app token. +- Copy the token. + +## Event Sink Tab + +The Event Sink tab connects Threat Prevention to Threat Manager through a uniform resource +identifier and the Threat Manager App Token. Policy event data is sent to Threat Manager through +this window. + +Follow the steps to configure Threat Prevention to send event data to Threat Manager. + +**Step 1 –** Generate the Threat Manager App Token in Threat Manager. + +**Step 2 –** In Threat Prevention, click **Configuration** > **Netwrix Threat Manager +Configuration** on the menu. The Netwrix Threat Manager Configuration window opens with the Event +Sink tab displayed by default. + +![Netwrix Threat Manager Configuration window - Event Sink tab](/images/threatprevention/8.1/admin/configuration/threatmanagerconfiguration.webp) + +**Step 3 –** In the Netwrix Threat Manager URI box, enter the Threat Manager hostname or IP address +and port in the following format. The default port for Threat Manager is **10001**. + +- amqp://[HOSTNAME | IPADDRESS]:[PORT] + - For an example with the host name – amqp://ExampleHost:10001 + - For an example with the host address – amqp://192.168.9.52:10001 + +:::warning +Do not use localhost for the hostname or 127.0.0.1 for the IP address. +::: + + +**Step 4 –** You can enable SSL for the AMQP event stream. + +As Threat Manager supports TLS/SSL, you can also enable SSL in Threat Prevention to enable +communication with Threat Manager in the secure way. + +- If Threat Manager has TLS enabled, then select the **Enable SSL** checkbox to enable the Agent to + send events to Threat Manager. Else the Agent will throw an error when connecting. +- Select the **Ignore Certificate Errors** checkbox to ignore certificate errors that may arise when + the Agent connects to Threat Manager. If this checkbox is not selected, the Agent will fail to + connect when there are certificate errors. + +**Step 5 –** In the App Token box, enter the App Token generated on the App Tokens page in Threat +Manager. + +**Step 6 –** The Policies area lists all the policies that have been created in Threat Prevention. +The following is displayed for each policy: + +- Send – When this checkbox is selected, the policy sends the event data to Threat Manager directly + from the Agent. This option can also be set by the Send to Netwrix Threat Manager checkbox on the + Actions tab of a policy. +- State – Displays whether the policy is enabled or disabled + The State column does not control the state of the policy. A policy can be enabled or disabled + either on the General tab of the respective policy or through the Policies Node Right-Click Menu. +- Name –Shows the display name of the policy +- Path – Displays the path of the policy within the structure of the Policies node in the left pane. + +**Step 7 –** Click **Save**. + +All real-time event data from the selected Threat Prevention policies is now being sent to Threat +Manager. + +:::note +The Threat Manager URI configuration can also be used to send Threat Prevention policy +data to the Activity Monitor host and port (example: amqp://localhost:4499). Threat Prevention can +only send to either Threat Manager or the Activity Monitor. +::: + + +## Honey Token Tab + +On the Honey Token tab, you specify a samAccountName, which is substituted with the replacement +samAccountName that you provide. The information on this tab is sent to the Threat Prevention Agent. +If the Agent sees an LDAP query using information from the Honey Token of fake accounts, it alters +the LDAP query results to return the Replacement samAccountName. This ensures the account looks like +a real privileged account to lure the perpetrator to it. + +Follow the steps to send the Honey Token to Threat Manager for an LDAP Deception trap. + +**Step 1 –** Configure the Source samAccountName and Replacement samAccountName in a Threat Manager +Honey Token threat. + +To set up a honey token, see the Configure Honeytoken Threats topic in the +[Netwrix Threat Manager Documentation](https://helpcenter.netwrix.com/category/stealthdefend). + +**Step 2 –** In Threat Prevention, click **Configuration** > **Netwrix Threat Manager +Configuration** on the menu. The Netwrix Threat Manager Configuration window opens. + +**Step 3 –** Ensure the Event Sink tab is properly set up to send event data to Threat Manager. + +**Step 4 –** Click the **Honey Token** tab. + +![Netwrix Threat Manager Configuration Window - Honey Tokem tab](/images/threatprevention/8.1/admin/configuration/honeytoken.webp) + +**Step 5 –** Check the **Enable LDAP substitution** checkbox to enable the options on the tab. + +**Step 6 –** Enter the exact match of settings configured for the Threat Manager Honey Token threat +for the following options: + +- Exact Match or Substring +- Source samAccountName +- Replacement samAccountName + +**Step 7 –** Click **Save**. + +The Honey Token is now enabled and integrated with Threat Manager. + +## Forged PAC Tab + +The Forged PAC tab provides the option to include Forged PAC information in the events Threat +Prevention sends to Threat Manager. + +Follow the steps to include the Forged PAC information in events. + +**Step 1 –** Under the Analytics node in the left pane, select the **Forged PAC** analytic. + +**Step 2 –** On the Forged PAC analytics window, select the gear icon on the upper-right corner of +the window to open the Configure Analytics window. + +**Step 3 –** Add or remove the RIDs of groups to be monitored on the Settings tab. See the +[Forged PAC Analytic Type](/docs/threatprevention/8.1/admin/analytics/forgedpac.md) topic for additional information. + +**Step 4 –** On the Policy tab, configure the following: + +- General Tab – Use the toggle to **Enable** the policy +- Event Type Tab – Keep the default settings or set as desired for the Authentication event filters +- Actions Tab – Select **Send to Threat Manager** + +**Step 5 –** Click Save once configurations are set. The Configure Analytics window closes. + +**Step 6 –** In Threat Prevention, click **Configuration** > **Netwrix Threat Manager +Configuration** on the menu. The Netwrix Threat Manager Configuration window opens. + +![Netwrix Threat Manager Configuration Window - Forged PAC tab](/images/threatprevention/8.1/admin/configuration/forgedpac.webp) + +**Step 7 –** Ensure the Event Sink tab is properly set up to send event data to Threat Manager. + +**Step 8 –** On the Forged PAC tab, select the **Include Forged PAC information in events** +checkbox. Click **Save**. + +When a Forged PAC analytic is triggered in Threat Prevention, the event data will be sent to Threat +Manager. diff --git a/docs/threatprevention/8.1/admin/configuration/userroles/_category_.json b/docs/threatprevention/8.1/admin/configuration/userroles/_category_.json new file mode 100644 index 0000000000..a7be09bb41 --- /dev/null +++ b/docs/threatprevention/8.1/admin/configuration/userroles/_category_.json @@ -0,0 +1,10 @@ +{ + "label": "Users and Roles Window", + "position": 110, + "collapsed": true, + "collapsible": true, + "link": { + "type": "doc", + "id": "overview" + } +} \ No newline at end of file diff --git a/docs/threatprevention/8.1/admin/configuration/userroles/add.md b/docs/threatprevention/8.1/admin/configuration/userroles/add.md new file mode 100644 index 0000000000..d488fbb7f5 --- /dev/null +++ b/docs/threatprevention/8.1/admin/configuration/userroles/add.md @@ -0,0 +1,41 @@ +--- +title: "Add Users" +description: "Add Users" +sidebar_position: 10 +--- + +# Add Users + +Follow the steps to add a user and assign access rights. + +![Add User button on the Users and Groups window](/images/threatprevention/8.1/admin/configuration/userroles/addbutton.webp) + +**Step 1 –** Click **Configuration** > **Users** on the menu to open the Users and Roles window. + +**Step 2 –** Click the **Add** (+) button in the upper-right corner; the Select Users or Groups +window opens. + +![Select Users or Groups window](/images/threatprevention/8.1/admin/configuration/userroles/selectusersorgroups.webp) + +**Step 3 –** Enter the name of the desired user in the Enter the object names to select box and +click Check Name. On the next window, select the required Active Directory user and click **OK**. +Click **OK** on the Select Users or Groups window to close it. The user is added to the Windows User +or Group list. + +**Step 4 –** At the bottom of the Users and Roles window, two user roles, Administrator and Console +Operator, are displayed. Select the checkbox for a role to assign it to the user. Checking +Administrator automatically checks the Console Operator role. + +:::tip +Remember, the Report User role was a legacy role for the IIS-based SI Reporting Console and does +not apply to the Netwrix Threat Manager Reporting Module console. See the +[User Access Page](/docs/threatprevention/8.1/reportingmodule/configuration/systemsettings/useraccess.md) topic for +information on granting report access. +::: + + +**Step 5 –** _(Optional)_ Create as many users as required before clicking OK. + +**Step 6 –** Click **OK** to save changes on the Users and Roles window. + +User(s) now have the appropriate access rights applied. diff --git a/docs/threatprevention/8.1/admin/configuration/userroles/delete.md b/docs/threatprevention/8.1/admin/configuration/userroles/delete.md new file mode 100644 index 0000000000..afea2ccd8e --- /dev/null +++ b/docs/threatprevention/8.1/admin/configuration/userroles/delete.md @@ -0,0 +1,25 @@ +--- +title: "Delete User" +description: "Delete User" +sidebar_position: 30 +--- + +# Delete User + +The Administration Console prevents you from deleting the last user with Administrator rights. There +must always be at least one active administrator. + +Follow the steps to delete a user. + +**Step 1 –** Click **Configuration** > **Users** on the menu to open the Users and Roles window. + +![Remove User button on the Users and Groups window](/images/threatprevention/8.1/admin/configuration/userroles/removeuser.webp) + +**Step 2 –** Select a user and click the **Remove** (x) button in the upper-right corner to delete +it. + +**Step 3 –** _(Optional)_ Delete as many users as desired before clicking OK. + +**Step 4 –** Click **OK** to save changes on this window. + +The deleted user(s) have no access to the Administration Console. diff --git a/docs/threatprevention/8.1/admin/configuration/userroles/modify.md b/docs/threatprevention/8.1/admin/configuration/userroles/modify.md new file mode 100644 index 0000000000..aefb3e44fc --- /dev/null +++ b/docs/threatprevention/8.1/admin/configuration/userroles/modify.md @@ -0,0 +1,28 @@ +--- +title: "Modify User Access" +description: "Modify User Access" +sidebar_position: 20 +--- + +# Modify User Access + +Follow the steps to modify a user’s assigned rights. + +**Step 1 –** Click **Configuration** > **Users** on the menu to open the Users and Roles window. + +![Users and Roles window](/images/threatprevention/8.1/admin/configuration/userroles/usersroleswindow.webp) + +**Step 2 –** Select a user to modify its assigned rights. + +- If the user is an administrator, you can deselect the Administrator checkbox and select the + Console Operator checkbox to downgrade the role. +- If the user is a Console Operator, simply select the Administrator checkbox to assign a higher + role to it. +- To manage some permissions for the Administrator role, see the + [Administrator Permissions](/docs/threatprevention/8.1/admin/configuration/userroles/overview.md#administrator-permissions) topic. + +**Step 3 –** _(Optional)_ Repeat this action for as many roles as required before clicking OK. + +**Step 4 –** Click OK to save changes on the Users and Roles window. + +User(s) now have the appropriate access rights updated. diff --git a/docs/threatprevention/8.1/admin/configuration/userroles/overview.md b/docs/threatprevention/8.1/admin/configuration/userroles/overview.md new file mode 100644 index 0000000000..c17055a4be --- /dev/null +++ b/docs/threatprevention/8.1/admin/configuration/userroles/overview.md @@ -0,0 +1,93 @@ +--- +title: "Users and Roles Window" +description: "Users and Roles Window" +sidebar_position: 110 +--- + +# Users and Roles Window + +On the Users and Roles window, you can grant role based access to users on the Administration +Console. See the +[User Access Page](/docs/threatprevention/8.1/reportingmodule/configuration/systemsettings/useraccess.md) topic for +information on granting access to the Netwrix Threat Manager Reporting Module console. + +Click **Configuration** > **Users** on the menu to open the Users and Roles window. + +![Users and Roles window](/images/threatprevention/8.1/admin/configuration/userroles/usersroleswindow.webp) + +:::note +This window is only available to Threat Prevention administrators. +::: + + +The user account that ran the installation is automatically set with the administrator role. This is +the only active user until more are added. This ensures that no unauthorized accounts can open the +Administration Console. + +## Roles + +There are two roles that can be applied to a Threat Prevention user: + +- Administrator – Full access to the Administration Console, though access can be restricted. See + the Administrator Permissions topic for additional information. +- Console Operator – Can create and run policies, and view event data. + +:::note +The Report User role was a legacy feature for the IIS-based Reporting Console and is no +longer applicable. See the [Reporting Module](/docs/threatprevention/8.1/reportingmodule/overview.md) topic for +information on the new reporting console. +::: + + +**Administration Console Rights** + +| | Administrator | Console Operator | +| ----------------------------------------------------------- | ------------------------------- | ------------------------------- | +| Log into the Administration Console | Yes | Yes | +| Create Policies and Policy Templates | Yes | Yes | +| View, Edit, or Delete Unprotected Policies | Yes | Yes | +| View, Edit, or Delete Protected Policies | According to Folder Permissions | According to Folder Permissions | +| Protect Policies at the Folder | Yes | Yes | +| Change Protected Folder Permissions | Yes\* | No | +| Set or Modify Administration Console Configuration Settings | Yes | No | +| Deploy and Manage Agent | Yes | No | +| Add or Remove Users | Yes | No | +| Modify User Access Rights | Yes | No | +| LDAP Operations Center | Yes | No | + +\*If an administrator changes permissions on protected policies they do not own, a system alert is +generated. + +See the [Policies Interface](/docs/threatprevention/8.1/admin/policies/overview.md) topic for information on protected and +unprotected policies. + +A user must have the following minimum permissions on the SQL Server databases, both the +NVMonitorConfig and NVMonitorData databases, according to the assigned role: + +- Administrator Role + + - Read/Write data + - If using [Database Maintenance Window](/docs/threatprevention/8.1/admin/configuration/databasemaintenance/overview.md) – SQL Admin (sa) + rights are required + +- Console Operator Role + + - Read/Write data + +## Administrator Permissions + +The Features button is enabled for users with the Administrator role. It provides options to limit +Administrator permissions to manage features, stop the Agent, or uninstall the Agent. + +![Users and Roles window showing the Edit Features window](/images/threatprevention/8.1/admin/configuration/userroles/featuresbutton.webp) + +Follow the steps to edit the features for the selected user. All listed features are enabled by +default. + +**Step 1 –** Click the **Features** button. The Edit features window opens. + +**Step 2 –** Check and uncheck features as desired. + +**Step 3 –** Click **OK**. + +The user is denied rights to the deselected features. diff --git a/docs/threatprevention/8.1/admin/investigate/_category_.json b/docs/threatprevention/8.1/admin/investigate/_category_.json new file mode 100644 index 0000000000..e26c62f1a0 --- /dev/null +++ b/docs/threatprevention/8.1/admin/investigate/_category_.json @@ -0,0 +1,10 @@ +{ + "label": "Investigate Interface", + "position": 60, + "collapsed": true, + "collapsible": true, + "link": { + "type": "doc", + "id": "overview" + } +} \ No newline at end of file diff --git a/docs/threatprevention/8.1/admin/investigate/datagrid.md b/docs/threatprevention/8.1/admin/investigate/datagrid.md new file mode 100644 index 0000000000..6cb10079b4 --- /dev/null +++ b/docs/threatprevention/8.1/admin/investigate/datagrid.md @@ -0,0 +1,128 @@ +--- +title: "Investigate Data Grid" +description: "Investigate Data Grid" +sidebar_position: 30 +--- + +# Investigate Data Grid + +Events are displayed in the data grid on the Investigate interface. + +Follow the steps to view events in the data grid. + +**Step 1 –** Click **Investigate** in the left pane to launch the Investigate interface. + +**Step 2 –** To expand the grid view, do either of the following: + +- Collapse the individual filter category sections +- Use the arrow between the filter categories and the grid view to collapse the entire filter + category section + +![Investigate interface - Data Grid](/images/threatprevention/8.1/admin/investigate/datagrid.webp) + +**Step 3 –** Select the **Production** or **Archive** option button to view events from the +respective database. + +The archive database is part of the Threat Prevention Database Maintenance feature and it can only +be queried from the Administration Console. See the +[Archive Data](/docs/threatprevention/8.1/admin/configuration/databasemaintenance/archive.md) topic for additional information. + +**Step 4 –** Use the **Get Top [number] Events** box to specify the number of events to be +displayed. + +**Step 5 –** Check the For Each Policy checkbox to view the specified number of events on a per +policy basis. If unchecked, the specified number of events displayed are solely based on the time +the event was logged. + +**Step 6 –** Use the Refresh button to repopulate the data grid with the current information for the +selected options. + +The Show All Columns link automatically adds any columns to the data grid that are currently hidden +from view. + +Each column in the data grid has a prefix identifying the type of information displayed. +Double-click a populated grid column to access the +[Event Viewer Window](/docs/threatprevention/8.1/admin/policies/configuration/recentevents/eventviewer.md) with detailed information on the +event. The columns display the following information for each event: + +- Event: Policy Name – Policy which monitored or blocked the event +- Event: Time Logged – Timestamp for when the event was monitored/blocked. The specified time is the + local time for the server where the Agent is deployed.Hover over the data in this column to view + the local time (of the Enterprise Manager) and UTC time simultaneously. +- Event: UTC Time Logged – UTC Timestamp for when the event was monitored/blocked by the Agent. + Hover over the data in this column to view the local time (of the Enterprise Manager) and UTC time + simultaneously. +- Affected Object: Path – Name of the affected object according to the type of monitoring/blocking + + - Active Directory monitoring/blocking – Active Directory distinguished name for the affected + object + - Effective Group Membership monitoring – Active Directory distinguished name for the affected + group. A double asterisk (\*\*) at the beginning indicates that the path is to the nested + group where the actual membership change occurred. + - Exchange monitoring/blocking – Name of the affected Exchange mailbox + - File System monitoring/blocking – Original path of the affected file or folder + - Authenticate – DN of the user object making the request + + :::note + For LDAP bind/monitoring/blocking, Affected Object Path is not used + ::: + + +- Agent: Domain – Active Directory domain where the Agent that monitored/blocked the event is + deployed +- Affected Object: Class – Active Directory class of the affected object +- Event: Type – Identifies the type of monitoring/blocking, e.g. Active Directory, File System, + Exchange +- Event: Raw Name – Short description of the monitored operation +- Perpetrator: DN – Distinguished name for the perpetrator account +- Agent: Computer – Server where the Agent is deployed +- Agent: IP Address – IP address of the server where the Agent is deployed +- Perpetrator: Access URL – Raw data, the combination of the protocol, IP address, and the Port used + as part of the event + + - Process Guardian monitoring/blocking – Process name that is modifying or attempting to modify + target process + +- Event: Success – Indicates the event completed successfully +- Event: Blocked – Indicates the Agent blocked the event from occurring +- Affected Object SID – Security Identifier of the object/account affected by the event +- Affected Object: Account Name – Security principal of the account affected by the event +- Affected Object GUID – The globally unique identifier of the object affected by the event +- Event: Name – Type of event monitored/blocked +- Perpetrator: Name – Security principal of the account that triggered the event +- Perpetrator: SID – Security Identifier of the account used in the event +- Perpetrator: Protocol – Protocol used for the monitored operation + + - File System monitoring/blocking – Name of the share where the operation was monitored/blocked. + It will be blank if the affected host has an operating system older than Windows Server 2008 + R2. + +- Perpetrator: IP Address – IP address of the originating host + + - File System monitoring/blocking – It will be blank if the affected host has an operating + system older than Windows Server 2008 R2. + +- Perpetrator: MAC Address – Network adapter identifier +- Perpetrator: Host – Name of the originating host +- Affected Object: IP Address – IP address of the host where the affected object resides +- Affected Object: Host – Name of the host the security principal is trying to access +- Event: Message – Result of the attempted operation +- Event: Count – Number of identical events that occurred in one minute + +Select an event in the data grid to view additional information for it at the bottom of the +Investigate interface. + +![Investigate Interface - Attributes area](/images/threatprevention/8.1/admin/investigate/attributes.webp) + +The following information (as applicable to the event) is displayed: + +- Attribute Name – The name of the object attribute that is affected +- Operation – The operation performed on the attribute +- Old Value – Value prior to the monitored change +- New Value – Value after the monitored change + +This data grid employs features for sorting, filtering, searching, and more. See the +[ Data Grid Functionality](/docs/threatprevention/8.1/admin/navigation/datagrid.md) topic for additional information. + +To export the data displayed in the grid to a CSV file, see the +[Export Data](/docs/threatprevention/8.1/admin/navigation/datagrid.md#export-data) topic. diff --git a/docs/threatprevention/8.1/admin/investigate/filters.md b/docs/threatprevention/8.1/admin/investigate/filters.md new file mode 100644 index 0000000000..b60cb46e59 --- /dev/null +++ b/docs/threatprevention/8.1/admin/investigate/filters.md @@ -0,0 +1,116 @@ +--- +title: "Investigate Filters" +description: "Investigate Filters" +sidebar_position: 40 +--- + +# Investigate Filters + +On the [Investigate Interface](/docs/threatprevention/8.1/admin/investigate/overview.md), there are six filter categories that can be applied to +the recent events available in the data grid. By default, no filters are applied. For the Policy +filter, all enabled unprotected policies and any protected policies the current user has rights to +view are selected, and the other filter categories are blank. Filters can be applied using any +combination of the filter categories. Use the Refresh button to repopulate the data grid with the +current information for the selected filter(s). + +![Investigate Interface - Filter Categories](/images/threatprevention/8.1/admin/investigate/filtercategories.webp) + +Filter categories are discussed below. + +**Policy** + +To filter by Policy, check the checkboxes for the desired policy. Protected policies that the +current user does not have rights to view are grayed-out. + +- All policies – Toggles on or off all available policies +- Show Deleted Policies – Displays previously deleted policies in the Policy filter category. They + are included in the filter. By default, event data from deleted policies is not included with the + investigation results. + +**Who** + +To filter by Who, check the Perpetrator box to filter for a particular security principal committing +the change and/or check the Affected Object box to filter for a particular object being affected by +a change. + +For the Perpetrator option, select the option button for either: + +- Name – Identify a perpetrator by name +- SID – Identify a perpetrator by the Security Identifier + +Then enter the who in the textbox or use the ellipsis (…) to open the Available Perpetrators window +that displays perpetrators currently known within the database. + +For the Affected Object option, select the option button for either: + +- DN / File Path – Identify an object by the distinguished name or file path +- Account – Identify an object by the SAM account name +- GUID – Identify an object by the globally unique identifier + +Then enter the who in the textbox. Filter criteria can be a partial match. + +**When** + +Filtering by When provides several options, including the option between using Local Time or UTC +time. + +- To filter from a specified date and time to the present, check the Between box and set the start + time and date +- To filter for everything before a specified date time, check the And box and set the end time and + date +- To filter for a specific time frame, check both the Between and And boxes, then set the start and + end times +- To filter for Events for Last [number] Hours, check this box and set the number of hours to be + used as the filter + +**Where** + +To filter by Where, check the box(es) for the desired filter type(s): + +- In this Domain – Enter the [domain name] in the textbox or use the ellipsis (…) to open the + Available Domains window that displays domains currently known within the database. +- Detected on Server – Select the radio button for either Name or IP and then enter the server in + the textbox. The ellipsis (…) can be used to open the Available Servers window that displays + servers currently known within the database. +- From This Computer – Select the radio button for either Name or IP and then enter the computer in + the textbox +- To This Computer – Select the radio button for either Name or IP and then enter the computer in + the textbox + +**Filter criteria can be a partial match** + +What + +To filter by What, check the box(es) for the desired filter type(s): + +- Event – Select the option button for either Success or Fail +- Action Type – Select the option button for either Blocked or Not Blocked + +**Other** + +To filter by Other, check the box(es) for the desired filter type(s): + +- Class +- Perpetrator Protocol +- Event Source +- Event Name +- Attribute Name +- Attribute Value – Select the option button for either Oldor New and then enter the old or new + value in the box + +Filter criteria can be a partial match. + +:::warning +The Full Text Search is not driven by indexes. Unless other indexed criteria are +selected, the full text search could result in a scan of the entire SQL database which could be very +slow for large databases. +::: + + +- Full Text Search – Queries the entire SQL database for the entered attribute. If the attribute + displays anywhere in the event, it is displayed in the data grid. + +Click the arrow on the filter category header ribbon to expand or collapse the category. You can +also clear all filters by clicking the Reset Filters button on the ribbon between the filter +categories and the data grid. Filtered views can also be saved. See the +[Saved Investigations](/docs/threatprevention/8.1/admin/investigate/saved.md) topic for additional information. diff --git a/docs/threatprevention/8.1/admin/investigate/overview.md b/docs/threatprevention/8.1/admin/investigate/overview.md new file mode 100644 index 0000000000..eb71e5f6b4 --- /dev/null +++ b/docs/threatprevention/8.1/admin/investigate/overview.md @@ -0,0 +1,26 @@ +--- +title: "Investigate Interface" +description: "Investigate Interface" +sidebar_position: 60 +--- + +# Investigate Interface + +The Investigate interface allows you to quickly view recent events in a centralized location. You +can investigate either Production events or Archive events. The data is limited by any protection +applied at the Policy folder-level. See the [Policies Interface](/docs/threatprevention/8.1/admin/policies/overview.md) topic for +additional information on the protection feature. + +Click **Investigate** in the left pane to launch the Investigate interface. + +![Investigate Interface](/images/threatprevention/8.1/admin/investigate/investigateinterface.webp) + +Next to the Investigate title, use the drop-down menu to select LDAP Policies or All Other Policies +to be shown in the data grid. Select the Show Deleted Policies checkbox to view deleted policies +too. + +The top section of the window provides filtering options. See the [Investigate Filters](/docs/threatprevention/8.1/admin/investigate/filters.md) +topic for additional information. The recent events are displayed in the bottom section. + +For an understanding of the data displayed in the grid, see the [Investigate Data Grid](/docs/threatprevention/8.1/admin/investigate/datagrid.md) +topic. diff --git a/docs/threatprevention/8.1/admin/investigate/saved.md b/docs/threatprevention/8.1/admin/investigate/saved.md new file mode 100644 index 0000000000..d26a05283f --- /dev/null +++ b/docs/threatprevention/8.1/admin/investigate/saved.md @@ -0,0 +1,26 @@ +--- +title: "Saved Investigations" +description: "Saved Investigations" +sidebar_position: 10 +--- + +# Saved Investigations + +You can apply filters on the [Investigate Interface](/docs/threatprevention/8.1/admin/investigate/overview.md) to filter event data as desired. +Filters settings can be saved. Follow the steps to save a filtered view. + +![Investigate Interface - Save a Filtered View](/images/threatprevention/8.1/admin/investigate/saveview.webp) + +**Step 1 –** Click **Investigate** in the left pane to launch the Investigate interface. + +**Step 2 –** Set the filter [1] as desired, Refresh the data grid [2], and click **Save Filter +Settings and Layout** [3]. The Filter Set Name window opens. + +![Filter Set Name window](/images/threatprevention/8.1/admin/investigate/filtersetname.webp) + +**Step 3 –** Type a name for this filtered view and click **OK**. + +![Saved filter view in the navigation pane](/images/threatprevention/8.1/admin/investigate/savedview.webp) + +The saved filtered view becomes a node in the Navigation pane under the Investigate node. Select the +node to return to the saved filtered Investigate view. diff --git a/docs/threatprevention/8.1/admin/investigate/summaryfolders.md b/docs/threatprevention/8.1/admin/investigate/summaryfolders.md new file mode 100644 index 0000000000..54c4a47a9a --- /dev/null +++ b/docs/threatprevention/8.1/admin/investigate/summaryfolders.md @@ -0,0 +1,67 @@ +--- +title: "Summary Folders" +description: "Summary Folders" +sidebar_position: 20 +--- + +# Summary Folders + +The EPE Summary and LDAP Summary folders under Investigate in the navigation pane are pre-defined +reports that allow you to view consolidated recent event activity for EPE or LDAP which spans all +EPE or LDAP policies. The reports include default grouping(s) that best show the consolidated data. + +![EPE Summary and LDAP Summary folders](/images/threatprevention/8.1/admin/investigate/summaryfolders.webp) + +The investigate summary folders have the following reports: + +- EPE Summary + - Last 10,000 Failed passwords by Policy and Rule + - Number of Failed passwords by Policy Name + - Number of Failed passwords by Rule Name + - Number of Failed passwords by Policy and Rule +- LDAP Summary + - Top 10,000 Most frequently run queries by User Accounts + - Top 10,000 Most frequently run queries by Computer Accounts + - Top 10,000 Most frequently run queries by IP + - Most frequently run queries by Account for TOP 5 User Accounts + - Most frequently run queries by Account for TOP 5 Computer Accounts + - Most frequently run queries by IP for TOP 5 IPs + - Run Time by Account + - Run Time by IP + - Run Time by Domain Controller + - Number of Searches by Domain Controller + +Click a report to view it. + +![Summary Report](/images/threatprevention/8.1/admin/investigate/summaryreport.webp) + +By default, the data grid is blank. Select **Refresh** to display results on the data grid. + +The grid view displays columns associated with the scope of the report. If there is no data +available, the grid does not populate but the columns display on the grid. The following buttons are +available below the report name: + +- Refresh – Repopulates the data grid with the current information for the selected report +- Configure – Opens the Parameters window. Set the optional time range as well as the type of + policies. +- Export – Export the selected report to an Excel, PDF, HTML, RTF, or CSV output. The Save As window + displays when an export option is selected. Provide a name for the report and save to a specified + location. + +**Parameter Window** + +![Parameter Window](/images/threatprevention/8.1/admin/investigate/parameter.webp) + +The Parameters window displays the following options. Select the desired options and click **OK** to +display data in the report accordingly. + +- Range From/To –If left unchecked, the report displays all policy data. When enabled, set a data + range for the data to be displayed in the report using the To and From dropdown calendars. By + default, the calendar displays today's date. Click **OK** to set the date and time. + + For faster navigation on the calendar, select the month to display all twelve months to choose + from. Once showing the months, select the year to display a range of years to choose from. + +- Policies – Choose **All** or **Enabled Only** to display all policies or enabled only policies in + the report +- Events – Select **All**, **Blocking** and/or **Monitoring** event(s) to display in the report diff --git a/docs/threatprevention/8.1/admin/navigation/_category_.json b/docs/threatprevention/8.1/admin/navigation/_category_.json new file mode 100644 index 0000000000..4ee7155632 --- /dev/null +++ b/docs/threatprevention/8.1/admin/navigation/_category_.json @@ -0,0 +1,10 @@ +{ + "label": "Navigation", + "position": 10, + "collapsed": true, + "collapsible": true, + "link": { + "type": "doc", + "id": "overview" + } +} \ No newline at end of file diff --git a/docs/threatprevention/8.1/admin/navigation/datagrid.md b/docs/threatprevention/8.1/admin/navigation/datagrid.md new file mode 100644 index 0000000000..446511783b --- /dev/null +++ b/docs/threatprevention/8.1/admin/navigation/datagrid.md @@ -0,0 +1,170 @@ +--- +title: "Data Grid Functionality" +description: "Data Grid Functionality" +sidebar_position: 20 +--- + +# Data Grid Functionality + +Result data is displayed using data grids on several interfaces in the Administration Console. These +grids employ features for data sorting, filtering, searching, and more. + +![Data Grid Functionality pointers](/images/threatprevention/8.1/admin/navigation/datagridfunctionality.webp) + +- The Group by Box [1] ribbon impacts how much data is displayed. See the Sort Data topic for + additional information. +- The Refresh [2] button populates the data grid with the current information according to the + selections. +- Columns can be reordered as desired as well as removed from the data grid. Removed columns can be + added back through the Customization Window. +- Many data grids also contain an Export Data [3] button. This provides different export options + with respect to the interface. See the Export Data topic for additional information. +- The Search [4] icon opens the **Enter text to search…** textbox where you can search for the + required data in the data grid. See the Search Data topic for additional information. +- The Auto Filter row [5] uses comparison operators to filter the grid against a single attribute. + See the Filter Data topic for additional information. + +## Customization Window + +Right-click on a column header and select **Column Chooser** to open the Customization window, that +lists the column(s) that were removed from the data grid display. + +![Customization Window](/images/threatprevention/8.1/admin/navigation/customization.webp) + +You can remove a columns from the data grid in any of these ways: + +- Drag the column and drop it into this window +- Right click in a column header and select **Hide This Column** + +A column can be returned to the data grid by double-clicking on it in the Customization window or by +dragging-and-dropping it from this window onto the column header row. + +## Sort Data + +Data can be grouped by columns using the Group by Box ribbon above the data grid. + +![Sort Data function in the data grid](/images/threatprevention/8.1/admin/navigation/sortdatafunction.webp) + +Drag a column header into the Group by Box area to group data from that perspective. You can group +by a single header or by tiered headers. + +Data can also be sorted alphanumerically ascending or descending by clicking on a column header. An +arrow displays in the right corner of the column header indicating the type of sorting. + +## Filter Data + +Several methods are available for filtering data in data grids. There can only be one active filter +per column. + +![Filter Data functions in a Data Grid](/images/threatprevention/8.1/admin/navigation/filterdata.webp) + +- Auto Filter Row [A] – Uses the comparison operator to filter the grid against a single attribute +- Filter Statement Bar [B] – Displays enabled filter statements at the bottom of the display area +- Filter Editor [C] – Build complex filter statements with multiple operators and column filters +- Pin Icon [D] – Opens a filtration dialog that provides multiple types of filtration options such + as  column values, text filters, and date filters associated with the column data + +**Auto Filter Row** + +The Auto Filter row is located between the header row and the first event of the data grid. Typing a +single attribute in any of these boxes or selecting an attribute from a dropdown menu filters the +data grid for matches within that column and the selected comparison operator. + +:::note +The Alerts grid does not display the Auto Filter Row by default. It must be selected +through the grid’s Show Auto Filter Row option from the right-click menu. +::: + + +**Filter Statement Bar** + +When a filter is enabled, the filter statement bar is displayed at the bottom of the display area. +The X to the left of the bar clears the filter. The checkbox for the filter on the left affects the +scoping of the filter. + +**Filter Editor** + +Notice the Edit Filter option on the right side of the filter statement bar. Click it to open the +Filter Editor window, where you can build complex filter statements. It can employ multiple +comparison operators and/or multiple column filters. + +![Filter Editor](/images/threatprevention/8.1/admin/navigation/filtereditor.webp) + +**Pin Icon** + +A small pin icon is displayed in the upper-right corner while hovering over a column header or if an +Auto Filter Row filter is enabled. + +Click the **pin icon** to open additional filtration options in a filter window. The options +displayed depend on the column it is opened from. + +![Window with filtration options](/images/threatprevention/8.1/admin/navigation/valuesfilter.webp) + +- Values – Displays for every column in the data grid. Multiple values can be selected. +- Text/Numeric – This is linked to the Auto filter Row filter with the addition of three new + filtration options including a custom filter option +- Date – Calendars with date timestamps display this filter with an array of scoping options + including a custom filter +- Custom Filter – Found within Text filters, this filter creates an AND or OR statement between two + filtered comparison values + +## Search Data + +The Find Panel enables you to search for data in the data grid. It is represented with a magnifying +glass icon. It is displayed by default but you can choose to hide or show it using the Show/Hide +Find Panel option on the +[Data Grid Right-Click Menu](/docs/threatprevention/8.1/admin/navigation/rightclickmenus.md#data-grid-right-click-menu). + +On clicking the magnifying glass icon, the Find box appears as: + +![Search function for data grid](/images/threatprevention/8.1/admin/navigation/searchfunction.webp) + +- Type a search criteria and click **Find**. The data grid filters to events where the search + criteria is matched, highlighting the match. +- The drop-down arrow in the textbox provides a history of recent searches for quick reference. +- Click **Clear** to clear both the search criteria and the filtered view. +- The **X** at the far left of the panel closes the Find Panel. + +![Search Results](/images/threatprevention/8.1/admin/navigation/searchresults.webp) + +## Export Data + +The data grids provide an option to export data. + +- Data grids on the Agents interface and on the Analytics windows export all available data from the + grid to a CSV file. Clicking the **Export** button from these interfaces opens a Save As window. +- Clicking the Export button from the Alerts interface opens the Alerts Export window. See the + [Alerts Export Window](/docs/threatprevention/8.1/admin/alerts/alertsexport.md) topic for additional information. +- Clicking the Export button from the Investigate interface or the Recent Events tab of a policy + opens the Export window. + +:::note +Ensure that all desired filters are set on the data grid before export. +::: + + +![Export window](/images/threatprevention/8.1/admin/navigation/export.webp) + +The Export window provides options for what is exported and what action(s) to take. + +In the Export options section, select the option buttons for the Columns and Rows subsections. + +- For Columns, you can export data displayed in Visible Columns Only or for All Columns. See the + Customization Window topic for details on selecting what columns are visible in a data grid. +- For Rows, the exported data can show All Rows or Filtered Only. + +In the Export Actions section, select where data will be exported. Check the boxes for Save File +Locally and/or Email to and populate the required fields. + +- For the Save File Locally action, a Save As window is displayed when you click Export. Use the + default path and file name to save the CSV file or choose another one. Then click Save.. +- For the Email to action, provide an email address for each recipient, which can be individuals, + distribution lists, or a combination. Use either a comma (,) or a semi-colon (;) to separate + multiple recipients. Click Export to export the data. + +:::note +The Email to action requires the SMTP host Information to be configured. This can only be +done by a Threat Prevention administrator through the +[Email Tab](/docs/threatprevention/8.1/admin/configuration/systemalerting/email.md) of the System Alerting window. + +::: diff --git a/docs/threatprevention/8.1/admin/navigation/licensemanager.md b/docs/threatprevention/8.1/admin/navigation/licensemanager.md new file mode 100644 index 0000000000..e29ee081c6 --- /dev/null +++ b/docs/threatprevention/8.1/admin/navigation/licensemanager.md @@ -0,0 +1,147 @@ +--- +title: "License Manager Window" +description: "License Manager Window" +sidebar_position: 30 +--- + +# License Manager Window + +The License Manager window displays the Threat Prevention modules that you are licensed for. If +under an Enterprise license, it also displays an expiration date. On license expiry, the Enterprise +Manager will refuse events from all Agents. + +:::tip +Remember, if events are not received and displayed in the Administration Console, check if your +license has expired. +::: + + +**Generate Alerts when the License Nears Expiration** + +You can configure alerts to be sent when the.Threat Prevention license nears expiration. These +alerts serve as a reminder for license renewal. + +To generate license expiration alerts 14 days prior to license expiry, enable the **License** option +on the [System Alerting Window](/docs/threatprevention/8.1/admin/configuration/systemalerting/overview.md). Go to the Email, Event +Log or SIEM tab depending on how you want to receive alerts (i.e., by email, in the Windows event +log, or in a SIEM product) and click Configuration in the left pane to locate the License option for +enabling it. + +The first alert is generated 14 days prior to license expiry and then every following day at 9:00 +AM. You can customize the time by modifying the following entry in the +SIEnterpriseManager.exe.config file: + +**** + +File path: `...\Netwrix\Netwrix Threat Prevention\SIEnterpriseManager` + +## View Licensing Information + +Follow the steps to view your Threat Prevention license details. + +Click **Help > License Manager** on the menu. The Netwrix Threat Prevention License Manager window +is displayed. + +![License Manager window](/images/threatprevention/8.1/admin/navigation/licensemanager.webp) + +This window lists the modules that you are licensed for. Each module is linked to a Threat +Prevention solution. + +Following is a list of the solutions with their respective modules. You can also view the event +types available with each module. + +:::note +The Password Enforcement module is available under all licenses for monitoring weak +passwords. However, you need the Enterprise Password Enforcer solution license to block weak +passwords. +::: + + +#### Active Directory Solution + +The Active Directory solution comes with the following licensed modules: + +| Licensed Module | Available Event Type | +| -------------------------- | ------------------------------ | +| Active Directory Changes | Active Directory Changes
Active Directory Read Monitoring
AD Replication Monitoring
Authentication Monitoring
Effective Group Membership
FSMO Role Monitoring
Process Guardian – Monitor | +| Active Directory Lockdown
\*Requires Active Directory Changes Module | Active Directory Lockdown
AD Replication Lockdown
Authentication Lockdown
Process Guardian – Protect | +| GPO Lockdown
\*Requires Active Directory Changes Module
\*\*Requires File System Module | GPO Setting Lockdown | +| GPO Setting Changes
\*Requires Active Directory Changes Module
\*\*Requires File System Module | GPO Setting Changes | + +See the following topics for additional information: + +- [Active Directory Changes Event Type](/docs/threatprevention/8.1/admin/policies/configuration/eventtype/activedirectorychanges.md) +- [Active Directory Lockdown Event Type](/docs/threatprevention/8.1/admin/policies/configuration/eventtype/activedirectorylockdown.md) +- [Active Directory Read Monitoring Event Type](/docs/threatprevention/8.1/admin/policies/configuration/eventtype/activedirectoryreadmonitoring.md) +- [AD Replication Monitoring Event Type](/docs/threatprevention/8.1/admin/policies/configuration/eventtype/adreplicationmonitoring.md) +- [AD Replication Lockdown Event Type](/docs/threatprevention/8.1/admin/policies/configuration/eventtype/adreplicationlockdown.md) +- [Authentication Monitoring Event Type](/docs/threatprevention/8.1/admin/policies/configuration/eventtype/authenticationmonitoring.md) +- [Authentication Lockdown Event Type](/docs/threatprevention/8.1/admin/policies/configuration/eventtype/authenticationlockdown.md) +- [Effective Group Membership Event Type](/docs/threatprevention/8.1/admin/policies/configuration/eventtype/effectivegroupmembership.md) +- [FSMO Role Monitoring Event Type](/docs/threatprevention/8.1/admin/policies/configuration/eventtype/fsmorolemonitoring.md) +- [GPO Setting Changes Event Type](/docs/threatprevention/8.1/admin/policies/configuration/eventtype/gposettingchanges.md) +- [GPO Setting Lockdown Event Type](/docs/threatprevention/8.1/admin/policies/configuration/eventtype/gposettinglockdown.md) +- [Process Guardian – Monitor Event Type](/docs/threatprevention/8.1/admin/policies/configuration/eventtype/lsassguardianmonitor.md) +- [Process Guardian – Protect Event Type](/docs/threatprevention/8.1/admin/policies/configuration/eventtype/lsassguardianprotect.md) + +#### Enterprise Password Enforcer Solution + +The Enterprise Password Enforcer solution comes with the following licensed modules: + +| Licensed Module | Available Event Type | +| --------------------------- | -------------------- | +| Password Enforcement Module | Password Enforcement | + +See the [Password Enforcement Event Type](/docs/threatprevention/8.1/admin/policies/configuration/eventtype/passwordenforcement/passwordenforcement.md) topics for +additional information. + +#### Exchange Solution + +The Exchange solution comes with the following licensed modules: + +| Licensed Module | Available Event Type | +| ---------------------------------------------------------- | -------------------- | +| Exchange Events Module | Exchange Changes | +| Exchange Lockdown Module
\*Requires Exchange Events Module | Exchange Lockdown | + +See the following topics for additional information: + +- [Exchange Changes Event Type](/docs/threatprevention/8.1/admin/policies/configuration/eventtype/exchangechanges.md) +- [Exchange Lockdown Event Type](/docs/threatprevention/8.1/admin/policies/configuration/eventtype/exchangelockdown.md) + +#### File System Solution + +The File System solution comes with the following licensed modules: + +| Licensed Module | Available Event Type | +| ------------------ | --------------------------- | +| File System Module | File System Changes
File System Lockdown
File System Enterprise Auditor | + +The File System Changes event type and File System Lockdown event type only generate event +monitoring and blocking data for Threat Prevention. The File System Enterprise Auditor event type +only generates event monitoring data for Netwrix Access Analyzer (formerly Enterprise Auditor). To +generate the same data to be accessible for both products, you must create a single policy with both +event types assigned. + +See the following topics for additional information: + +- [File System Changes Event Type](/docs/threatprevention/8.1/admin/policies/configuration/eventtype/filesystemchanges/filesystemchanges.md) – For Windows file + servers and/or NAS devices +- [File System Lockdown Event Type](/docs/threatprevention/8.1/admin/policies/configuration/eventtype/filesystemlockdown.md) – For Windows file + servers +- [File System Enterprise Auditor Event Type](/docs/threatprevention/8.1/admin/policies/configuration/eventtype/filesystemaccessanalyzer.md) + – For Windows file servers + +#### LDAP Solution + +The LDAP solution comes with the following licensed modules: + +| Licensed Module | Available Event Type | +| -------- | ------------ | +| LDAP Monitoring Module
\*Requires Active Directory Changes Module | LDAP Lockdown
LDAP Monitoring
LDAP Bind Monitoring | + +See the following topics for additional information: + +- [LDAP Monitoring Event Type](/docs/threatprevention/8.1/admin/policies/configuration/eventtype/ldapmonitoring/ldapmonitoring.md) +- [LDAP Lockdown Event Type](/docs/threatprevention/8.1/admin/policies/configuration/eventtype/ldaplockdown.md) +- [LDAP Bind Monitoring Event Type](/docs/threatprevention/8.1/admin/policies/configuration/eventtype/ldapbindmonitoring.md) diff --git a/docs/threatprevention/8.1/admin/navigation/overview.md b/docs/threatprevention/8.1/admin/navigation/overview.md new file mode 100644 index 0000000000..177a21d479 --- /dev/null +++ b/docs/threatprevention/8.1/admin/navigation/overview.md @@ -0,0 +1,151 @@ +--- +title: "Navigation" +description: "Navigation" +sidebar_position: 10 +--- + +# Navigation + +The Threat Prevention Administration Console is used to: + +- Create and configure policies and policy templates +- Configure analytics +- Deploy and manage Agents +- Import and export Threat Prevention policies and policy templates +- Configure alerts + +Policies control the real-time event monitoring/blocking of files and directories, users, groups, +Active Directory objects, and Microsoft Exchange objects. These policies enable Threat Prevention to +detect and report changes as well as send notification when changes occur. + +## Administration Console Components + +The Administration Console has the following components: + +- Menu +- Policy Center +- Status Bar + +![Threat Prevention Administration Console – Components](/images/threatprevention/8.1/admin/navigation/adminconsole.webp) + +There are also right-click commands available within different sections of the Policy Center. + +If the Administration Console user interface or windows do not display properly, see the +[Troubleshooting FAQs](/docs/threatprevention/8.1/troubleshooting/overview.md#troubleshooting-faqs) topic for +information. + +## Menu + +The Menu contains the following selections: + +![Administration Console - Menu](/images/threatprevention/8.1/admin/navigation/menu.webp) + +| Menu Item | Option | Description | +| ------------- | ------------------- | ------------------- | +| File | New | Create new policies (Ctrl+P), new templates (Ctrl+T), or new folders (Ctrl+F) in the selected location of the Policy Center | +| | Rename | Opens a textbox to rename the selected policy, template, or folder in the Policy Center | +| | Remove | Removes the selected policy, template, or folder from the Policy Center | +| | Exit | Exit the Administration Console | +| Tools | Export … | Export (Alt+X) policies and templates through the [Export Policies and Templates Window](/docs/threatprevention/8.1/admin/tools/exportpoliciestemplates.md) | +| | Import … | Import (Alt+I) policies/templates, collections, and event consumers/alerts from an exported file through the [Import Window](/docs/threatprevention/8.1/admin/tools/import.md) | +| Configuration | Alerts | Configure and manage all email, event log, and SEIM alerts in the [System Alerting Window](/docs/threatprevention/8.1/admin/configuration/systemalerting/overview.md) | +| | Users | A security feature for configuring access to the Administration Console. Users are added and assigned rights through the [Users and Roles Window](/docs/threatprevention/8.1/admin/configuration/userroles/overview.md). | +| | Database > Server | Manage the events database in the [Events Database Configuration Window](/docs/threatprevention/8.1/admin/configuration/eventsdatabaseconfiguration.md). You can view the information, but cannot make changes. | +| | Database > Maintenance | Use database maintenance to automatically groom the database to optimize performance by archiving and/or deleting data aged beyond a specified threshold. This can be configured to run by Event Type, Analytic, or Policy. It is configured in the [Database Maintenance Window](/docs/threatprevention/8.1/admin/configuration/databasemaintenance/overview.md). | +| | Collections | Manage all Microsoft Collections in the [Collection Manager Window](/docs/threatprevention/8.1/admin/configuration/collectionmanager/overview.md) | +| | Event Filtering | Filters Active Directory events to remove “noise” from collected event data and/or exclude logins from machine accounts. Both settings are ON by default. It also allows authentication events from selected hosts or from selected accounts to be excluded, which require configuration before being enabled. A latency threshold can be set to generate alerts when the delivery of AD Events are delayed beyond the threshold. These options are configured in the [Event Filtering Configuration Window](/docs/threatprevention/8.1/admin/configuration/eventfilteringconfiguration.md). | +| | Netwrix Threat Manager Configuration | Enables integration between Threat Prevention and Threat Manager in a global setting. The Threat Manager URI is set in the [Netwrix Threat Manager Configuration Window](/docs/threatprevention/8.1/admin/configuration/threatmanagerconfiguration.md). Choose policies through the Policy checkboxes in this window or the Actions tab of each policy for sending event data to Threat Manager. | +| | File Monitor Settings | Manages the log retention, inherited permissions filtering, disables office file filtering, and the ability to exclude AD accounts and processes for Threat Prevention file monitoring and blocking policies in a global setting. These options are set in the [File Monitor Settings Window](/docs/threatprevention/8.1/admin/configuration/filemonitorsettings.md). | +| | EPE Settings | Manages the Have I Been Pwned password hash database configuration and update options as well as global Password Rules filter configurations. These options are configured in the [EPE Settings Window](/docs/threatprevention/8.1/admin/configuration/epesettings.md). | +| Help | Administration Console Help | Opens the internal help documentation | +| | License Manager | Opens the Threat Prevention [License Manager Window](/docs/threatprevention/8.1/admin/navigation/licensemanager.md) where the customer name, license expiry date, and licensed modules are displayed | +| | About Netwrix Threat Prevention Administration Console | Opens the Administration Console window where the product version, copyright, and the Netwrix website link are displayed | + +## Policy Center + +The Policy Center is the primary interface of the Administration Console. It is divided into two +sections: the Navigation pane and the Display area. + +![Administration Console – Policy Center](/images/threatprevention/8.1/admin/navigation/policycenter.webp) + +The Navigation pane provides interface options while the Display area displays the selected +interface. The following interface options are available: + +- [Agents Interface](/docs/threatprevention/8.1/admin/agents/overview.md) +- [Alerts Interface](/docs/threatprevention/8.1/admin/alerts/overview.md) +- [Investigate Interface](/docs/threatprevention/8.1/admin/investigate/overview.md) +- [Analytics Interface](/docs/threatprevention/8.1/admin/analytics/overview.md) +- [Policies Interface](/docs/threatprevention/8.1/admin/policies/overview.md) +- [Templates Interface](/docs/threatprevention/8.1/admin/templates/overview.md) +- [Tags Node](/docs/threatprevention/8.1/admin/tags.md) + +Several right-click menus and additional features are available within these interfaces. + +:::tip +Remember, the Investigate, Analytics, Policies, Templates, and TAGS nodes in the Navigation pane +can be expanded and collapsed. +::: + + +**Agents** + +The Agents interface provides data about the Agents within the environment. This includes what +domain the Agent is in, what machine it is deployed on, its current status, and other details. This +interface also indicates if a domain controller does NOT have an Agent deployed on it. Through this +interface, Agents can be deployed, updated, and managed; logging levels can be configured; logs can +be accessed; and Agent information can be exported. + +**Alerts** + +The Alerts interface provides information on the Threat Prevention Security events, Operations +events, and Configuration events. All events are displayed by default. However, they can be +filtered, sorted, and searched. + +**Investigate** + +The Investigate interface is a reporting tool for the Administration Console. It provides +information on recent events monitored or blocked by any enabled policy. By default, all events +recently monitored or blocked are available. However, they can be filtered to particular policies, +perpetrators, time frames, domains, servers, computers, events, etc. + +**Analytics** + +The Analytics interface is a front-line warning tool for detecting incidents in real-time based on +patterns within collected event data indicative of potential security risk. It provides information +on incidents identified by the analytic policies. + +**Policies** + +The Policies interface provides a central location for creating and configuring all policies. On +selecting the Policy node, the policies are listed in the Display area. In the Navigation pane, the +policies are organized into folders. By default, the folder structure is comprised of but not +limited to three folders: Auditing, Blocking, and Notifications, representing the most common types +of policies enabled by users. Policies can be configured to monitor or block Windows Active +Directory events, Windows Exchange Server 2010, 2013, 2016 and 2019 events, Windows File System +events, NetApp File System events, EMC File System events, and Group Policy Objects events. + +A folder can be protected, which controls access to any policy within the folder. A protected policy +cannot be viewed, edited, or deleted by other Administration Console users without explicit +permissions being granted. + +**Templates** + +The Templates interface provides a central location for creating and configuring all policy +templates. On selecting the Templates node, a list of all policy templates available is displayed in +the Display area. Policy templates must also be stored within a folder. There are pre-created policy +templates which can be imported. + +**TAGS** + +The TAGS node provides an organizational feature for templates. Many preconfigured templates have +tags which enable users to quickly find a desired template though various groupings. Tags do not +create a duplicate template, but rather display the template in different folders under the TAGS +node. + +## Status Bar + +The Status Bar is located at the bottom of the Administration Console. + +![statusbar](/images/threatprevention/8.1/admin/navigation/statusbar.webp) + +It displays the current user account logged into Threat Prevention and current session details. diff --git a/docs/threatprevention/8.1/admin/navigation/rightclickmenus.md b/docs/threatprevention/8.1/admin/navigation/rightclickmenus.md new file mode 100644 index 0000000000..0fe3f9c2c8 --- /dev/null +++ b/docs/threatprevention/8.1/admin/navigation/rightclickmenus.md @@ -0,0 +1,132 @@ +--- +title: "Right-Click Menus" +description: "Right-Click Menus" +sidebar_position: 10 +--- + +# Right-Click Menus + +In the Navigation pane, the Policies node, Templates node, folders, policies, and templates have +different right-click commands available. + +**Alerts Node** + +From the Agents node, the right-click menu can be used to install the Agent. + +![Agents node - Right-click Menu](/images/threatprevention/8.1/admin/navigation/agentsmenu.webp) + +| Right-Click Command | Description | +| ------------------- | ----------------------- | +| Install Agent | Opens the [Deploy Agents Wizard](/docs/threatprevention/8.1/admin/agents/deploy/overview.md#deploy-agents-wizard) | + +**Saved ‘Filtered Investigate’ Nodes** + +From the node of a saved ‘Filtered Investigate’ view, the right-click menu allows you to delete the +saved view. + +![Saved ‘Filtered Investigate’ Nodes - Right-click Menu](/images/threatprevention/8.1/admin/navigation/savedinvestigateviewnode.webp) + +| Right-Click Command | Description | +| ------------------- | --------------------------------------------- | +| Delete | Deletes the saved ‘Filtered Investigate’ view | + +**Policies and Templates Nodes** + +From the Policies and Templates nodes, the right-click menu is limited to adding new folders to the +selected section. + +![Policies and Templates Nodes - Right-click Menu](/images/threatprevention/8.1/admin/navigation/policiestemplatesnodes.webp) + +| Right-Click Command | Description | +| --------------------- | --------------------------------------------- | +| New — Folder (Crtl+F) | Creates a new folder in the selected location | + +**Folder Node** + +From a Folder node, the right-click menu contains these commands. + +![Folder Node - Right-click Menu](/images/threatprevention/8.1/admin/navigation/foldermenu.webp) + +| Right-Click Command | Description | +| ----------------------- | ---------------------- | +| New — Policy (Crtl+P) | Creates a new policy in the selected location. Only available for folders under the Policies node. | +| New — Template (Crtl+T) | Creates a new template in the selected location. Only available for folders under the Templates node. | +| New — Folder (Crtl+F) | Creates a new folder in the selected location | +| Rename | Opens a textbox to rename the selected folder | +| Remove | Deletes the selected folder | +| Paste | Pastes a copied policy/template into the selected folder | + +:::note +If the logged in user does not have the **Manage Policies** permissions for a protected +policy, these options are grayed-out. See the [Policies Interface](/docs/threatprevention/8.1/admin/policies/overview.md) topic +for additional information on protection. +::: + +**Policy Name and Template Name** + +From the node for a specific policy or template, the right-click menu contains these commands. + +![`` and `