docs(threatprevention): add 8.1 documentation

docs/kb/threatprevention/troubleshooting-and-diagnostics/enabling-additional-logging-for-the-threat-prevention-admin-console.md

@@ -13,47 +13,39 @@ keywords:
   - SIWinConsole
   - Update Log Levels
 products:
-  - threat-prevention
-sidebar_label: Enabling additional logging for the Threat Prevent
-tags: []
-title: "Enabling additional logging for the Threat Prevention Admin Console"
+  - threatprevention
+sidebar_label: "Enabling Additional Logging for the Threat Prevention Admin Console"
+tags:
+  - kb
+title: "Enabling Additional Logging for the Threat Prevention Admin Console"
 knowledge_article_id: kA04u0000000I2PCAU
 ---
 
-# Enabling additional logging for the Threat Prevention Admin Console
+# Enabling Additional Logging for the Threat Prevention Admin Console
 
-## Summary
-Enabling additional logging for the Threat Prevention Admin Console
-
-## Issue
-How to enable additional logging for the Threat Prevention Admin Console.
+## Overview
+This article describes how to enable additional logging for the Threat Prevention Admin Console.
 
 ## Instructions
-There are two options for enabling additional logging:
+There are two options: edit the log config file directly on the SI management server, or update the log level from within the Admin Console.
+
+> **NOTE:** Version 8.1 changed the logging engine used by the Admin Console, so the `SIWinConsole.log.config` file has a different format. In version 8.1 and later:
+>
+> - The root element is `<nlog>` instead of `<log4net>`, and the `minlevel` attribute on a `<logger>` rule sets the log level rather than a `<level>` element.
+> - Saving the file applies the change immediately. Restarting the Admin Console is not necessary.
+> - Option 2 writes a log level back to the configuration file, so it survives a restart.
 
-### Option one
+### Option 1
 1. Access the SI management server.
 2. Open the Enterprise Manager installation folder. The default location is `...\STEALTHbits\StealthINTERCEPT\SIWinConsole`.
 3. Edit the file called `SIWinConsole.log.config` in your favorite text editor.
-4. Change `WARN` to `DEBUG` in the following portion of that file:
-
-```
-
-```
+4. Change `WARN` to `DEBUG` in the file, then save the config file and restart the Threat Prevention Admin Console.
 
-5. Save the config file and restart the Threat Prevention Admin Console.
-
-### Option two
-1. Open the Threat Prevention Admin Console on the SI management server.
+### Option 2
+1. Open the **Threat Prevention Admin Console** on the SI management server.
 2. Select **Agents**.
-3. Click on the Pencil icon at the top left of the window.
+3. Click the **Pencil** icon at the top left of the window.
 4. Change the drop-down under **Administration Console** to `DEBUG`.
-5. Click the **Update Log Levels** button.
+5. Click the **Update Log Levels** button to apply the change.
 
 After collecting debug logs switch Threat Prevention Admin Console logging back to `WARN`.
-
-## Module
-SI - Admin Console
-
-## Salesforce Article ID
-000001063

docs/kb/threatprevention/troubleshooting-and-diagnostics/enabling-debug-logging-on-the-steathintercept-windows-agent.md

@@ -1,52 +1,56 @@
 ---
 description: >-
-  Shows how to enable debug logging for the Netwrix Threat Manager Windows agent
-  by editing the agent log config or updating log levels from the Threat
-  Prevention Administration Console.
+  Shows how to enable debug logging for the Netwrix Threat Prevention Windows
+  agent by editing the agent log config or updating log levels from the
+  Threat Prevention Administration Console.
 keywords:
   - debug logging
   - Windows agent
   - SIWindowsAgent
   - log config
   - DEBUG
   - WARN
-  - Netwrix Threat Manager
+  - Netwrix Threat Prevention
   - Threat Prevention Administration Console
 products:
-  - threat-prevention
-sidebar_label: Enabling debug logging on the Netwrix Threat Manager Windows agent
-tags: []
-title: "Enabling debug logging on the Netwrix Threat Manager Windows agent"
+  - threatprevention
+sidebar_label: "Enabling Debug Logging on the Netwrix Threat Prevention Windows Agent"
+tags:
+  - kb
+title: "Enabling Debug Logging on the Netwrix Threat Prevention Windows Agent"
 knowledge_article_id: kA04u0000000I2dCAE
 ---
 
-# Enabling debug logging on the Netwrix Threat Manager Windows agent
+# Enabling Debug Logging on the Netwrix Threat Prevention Windows Agent
 
-## Summary
-Enabling debug logging on the Netwrix Threat Manager Windows agent.
-
-## Issue
-How to enable debug logging on the Netwrix Threat Manager Windows agent.
+## Overview
+This article describes how to enable debug logging on the Netwrix Threat Prevention Windows agent.
 
 ## Instructions
-There are two options.
+There are two options: edit the agent's log config file directly on the server running the agent, or update the log level for one or more agents remotely from the Administration Console.
+
+> **NOTE:** Version 8.1 changed the logging engine used by the agent, so the `SIWindowsAgent.log.config` file has a different format. In version 8.1 and later:
+>
+> - The root element is `<nlog>` instead of `<log4net>`, and the `minlevel` attribute on a `<logger>` rule sets the log level rather than a `<level>` element.
+> - Saving the file applies the change immediately. Restarting the `SIWindowsAgent` service is not necessary.
+> - Option 2 writes a log level back to the configuration file, so it survives a service restart.
 
 ### Option 1
 1. Access the server with the SI Windows agent running.
 2. Open the Windows Agent installation folder. The default location is `...\STEALTHbits\StealthINTERCEPT\SIWindowsAgent\`
 3. Edit the file named `SIWindowsAgent.log.config` in your favorite text editor.
 4. Change `WARN` to `DEBUG` in the appropriate portion of that file:
 
-   ![LogConfig.png](../0-images/ka0Qk000000DmDJ_0EM4u000004d1hf.png)
+   ![Log config file with the WARN value changed to DEBUG](../0-images/ka0Qk000000DmDJ_0EM4u000004d1hf.png)
 
 5. Save the `.log.config` file and restart the `SIWindowsAgent` service.
 
 ### Option 2
-1. Open the Netwrix Threat Prevention Administration Console on the SI management server.
+1. Open the **Netwrix Threat Prevention Administration Console** on the SI management server.
 2. Select **Agents**.
-3. Click on the Pencil icon at the top left of the window.
+3. Click the **Pencil** icon at the top left of the window.
 4. Change the drop-down under **New Agent Log Level** to `DEBUG`.
-5. Highlight the desired agents you wish to change the log level of from the list below.
-6. Click the **Update Log Levels** button.
+5. Select the agents whose log level you want to change from the list below.
+6. Click the **Update Log Levels** button to apply the change.
 
 After collecting debug logs, set Netwrix Threat Prevention Windows agent logging back to `WARN`.

docs/threatprevention/8.1/admin/_category_.json

@@ -0,0 +1,10 @@
+{
+  "label": "Administration",
+  "position": 40,
+  "collapsed": true,
+  "collapsible": true,
+  "link": {
+    "type": "doc",
+    "id": "overview"
+  }
+}

docs/threatprevention/8.1/admin/agents/_category_.json

@@ -0,0 +1,10 @@
+{
+  "label": "Agents Interface",
+  "position": 40,
+  "collapsed": true,
+  "collapsible": true,
+  "link": {
+    "type": "doc",
+    "id": "overview"
+  }
+}

docs/threatprevention/8.1/admin/agents/agent-management/_category_.json

@@ -0,0 +1,6 @@
+{
+  "label": "Agent Management",
+  "position": 40,
+  "collapsed": true,
+  "collapsible": true
+}

docs/threatprevention/8.1/admin/agents/agent-management/clearqueue.md

@@ -0,0 +1,62 @@
+---
+title: "Clear SQLite Agent Queue"
+description: "Clear SQLite Agent Queue"
+sidebar_position: 80
+---
+
+# Clear SQLite Agent Queue
+
+When the Agent is unable to communicate with the Enterprise Manager, Agent events queue up in the
+Agents local SQLite database until the Enterprise Manager is available to accept events. The Clear
+SQLite Agent Queue option dumps the queue and discards all pending events.
+
+To clear the SQLite Agent queue for an Agent:
+
+:::warning
+Threat Prevention permanently deletes these events, and the Enterprise Manager doesn't
+process them on reconnection. This option is for diagnostic and troubleshooting purposes only.
+:::
+
+
+**Step 1 –** Click Agents in the left pane to launch the Agents interface.
+
+**Step 2 –** Right-click a server/Agent and select **Clear SQLite Agent Queue** on the menu.
+
+![Enter Credentials window](/images/threatprevention/8.1/install/upgrade/entercredentials.webp)
+
+**Step 3 –** On the Enter Credentials window, enter a username and password with sufficient rights
+to connect to the target machine and query information about shares. A local Administrator account
+on the target machine should have access to the system shares. Click **OK** after entering the
+credentials.
+
+:::note
+The wizard doesn't block access to the Administration Console, and you can minimize it while
+actions are in progress. If you hide the wizard by clicking outside of the dialog box, a flashing
+blue link with the action name displays in the upper right corner of the interface. Click
+the flashing link to return the focus to the wizard.
+:::
+
+
+**Step 4 –** On the Access Verification window, the system performs a prerequisites or verification
+check that can fail or succeed.
+
+- Failed – Read the failure messages and close the window. Resolve any error messages before the
+  next attempt.
+- Success – Click **Next** to begin clearing the SQLite Agent Queue
+
+:::note
+Closing the Administration Console while this action is in process causes problems with
+data collection.
+:::
+
+
+**Step 5 –** The Clear Agent Queue window displays the task in progress and then its status as
+either:
+
+- Failed – Read the failure messages and close the window. Resolve any error messages before the
+  next attempt.
+- Completed – Indicates that the task is completed
+
+**Step 6 –** When the task is successfully completed, click **Finish** to close the window.
+
+Threat Prevention automatically clears the SQLite Agent queue.

docs/threatprevention/8.1/admin/agents/agent-management/harden.md

@@ -0,0 +1,47 @@
+---
+title: "Harden Agent"
+description: "Harden Agent"
+sidebar_position: 40
+---
+
+# Harden Agent
+
+You can harden an Agent to prevent anyone from altering, stopping, or starting it from within the
+local Service Control Manager.
+
+To harden the Agent on a server:
+
+**Step 1 –** Click Agents in the left pane to launch the Agents interface.
+
+**Step 2 –** Right-click a server/Agent and select **Harden Agent** on the menu.
+
+**Step 3 –** On the Access Verification window, the system performs a prerequisites or verification
+check that can fail or succeed.
+
+- Failed – Read the failure messages and close the window. Resolve any error messages before the
+  next attempt.
+- Success – Click **Next** to begin hardening the Agent.
+
+:::note
+The wizard doesn't block access to the Administration Console, and you can minimize it while
+actions are in progress. If you hide the wizard by clicking outside of the dialog box, a flashing
+blue link with the action name displays in the upper right corner of the interface. Click
+the flashing link to return the focus to the wizard.
+:::
+
+
+:::note
+Closing the Administration Console while this action is in process causes problems with
+data collection.
+:::
+
+
+**Step 4 –** The Harden Agent window displays the task in progress and then its status as either:
+
+- Failed – Read the failure messages and close the window. Resolve any error messages before the
+  next attempt.
+- Completed – Indicates that the task is completed
+
+**Step 5 –** When the task is successfully completed, click **Finish** to close the window.
+
+The Agent's status changes to _Hardened_.

docs/threatprevention/8.1/admin/agents/agent-management/removeserver.md

@@ -0,0 +1,24 @@
+---
+title: "Remove Server from List"
+description: "Remove Server from List"
+sidebar_position: 70
+---
+
+# Remove Server from List
+
+The Agents Interface displays a list of servers where the Agent is deployed. You can remove a server
+from this list for any reason, such as when the server no longer needs the Agent.
+
+:::note
+If the server has a deployed Agent, Threat Prevention adds the server back to the list the
+next time the Agent sends information to the Enterprise Manager.
+:::
+
+
+To remove a server from the list on the Agents Interface:
+
+**Step 1 –** Click Agents in the left pane to launch the Agents interface.
+
+**Step 2 –** Right-click a server and select **Remove Server from List** on the menu.
+
+Threat Prevention removes the server from the list.

docs/threatprevention/8.1/admin/agents/agent-management/soften.md

@@ -0,0 +1,47 @@
+---
+title: "Soften Agent"
+description: "Soften Agent"
+sidebar_position: 50
+---
+
+# Soften Agent
+
+You can soften a previously hardened Agent. Softening unlocks the Agent so it can be controlled from
+within the local Service Control Manager.
+
+To soften the Agent on a server:
+
+**Step 1 –** Click Agents in the left pane to launch the Agents interface.
+
+**Step 2 –** Right-click a hardened Agent and select **Soften Agent** on the menu.
+
+**Step 3 –** On the Access Verification window, the system performs a prerequisites or verification
+check that can fail or succeed.
+
+- Failed – Read the failure messages and close the window. Resolve any error messages before the
+  next attempt.
+- Success – Click **Next** to begin softening the Agent.
+
+:::note
+The wizard doesn't block access to the Administration Console, and you can minimize it while
+actions are in progress. If you hide the wizard by clicking outside of the dialog box, a flashing
+blue link with the action name displays in the upper right corner of the interface. Click
+the flashing link to return the focus to the wizard.
+:::
+
+
+:::note
+Closing the Administration Console while this action is in process causes problems with
+data collection.
+:::
+
+
+**Step 4 –** The Soften Agent window displays the task in progress and then its status as either:
+
+- Failed – Read the failure messages and close the window. Resolve any error messages before the
+  next attempt.
+- Completed – Indicates that the task is completed
+
+**Step 5 –** When the task is successfully completed, click **Finish** to close the window.
+
+The Agent is no longer hardened.