diff --git a/docs/auditor/10.9/admin/healthstatus/dashboard/overview.md b/docs/auditor/10.9/admin/healthstatus/dashboard/overview.md index de28efbd94..af74babd4d 100644 --- a/docs/auditor/10.9/admin/healthstatus/dashboard/overview.md +++ b/docs/auditor/10.9/admin/healthstatus/dashboard/overview.md @@ -12,8 +12,8 @@ health and storage capacity. The dashboard comprises a set of widgets that displ these aspects using aggregated statistics and charts. Nearly every widget lets you explore detailed information about the aspect you're interested in. -To view the dashboard, on the main Auditor page, click the Health status tile located in the -Configuration section. +To view the dashboard, on the main Auditor page, click the Health status tile in the Configuration +section. The dashboard includes the following widgets: @@ -21,10 +21,10 @@ The dashboard includes the following widgets: produced and Netwrix Auditor collected and saved during the last 7 days. See the [Activity Records Statistics](/docs/auditor/10.9/admin/healthstatus/dashboard/activityrecordstatistics.md) topic for additional information. - The Monitoring overview widget—Shows aggregated statistics on the statuses of all monitoring plans - configured in Netwrix Auditor at the moment. See the [Monitoring Overview](/docs/auditor/10.9/admin/healthstatus/dashboard/monitoringoverview.md) + configured in Netwrix Auditor. See the [Monitoring Overview](/docs/auditor/10.9/admin/healthstatus/dashboard/monitoringoverview.md) topic for additional information. -- The Health log chart—Shows the statistics on the events written in the Netwrix Auditor health log - in the last 24 hours. Click the link in this widget to view the log. See the +- The Health log chart—Shows statistics on the events Netwrix Auditor wrote to the health log in the + last 24 hours. Click the link in this widget to view the log. See the [Netwrix Auditor Health Log](/docs/auditor/10.9/admin/healthstatus/dashboard/healthlog.md) topic for additional information. - The Database statistics widget—Helps you to estimate database capacity on the default SQL Server instance that hosts the product databases. See the [Database Statistics](/docs/auditor/10.9/admin/healthstatus/dashboard/databasestatistics.md) @@ -42,5 +42,5 @@ The dashboard includes the following widgets: ![healthstatusdashboard_thumb_0_0](/images/auditor/10.9/admin/healthstatus/dashboard/healthstatusdashboard_thumb_0_0.webp) You can also instruct Netwrix Auditor to forward similar statistics as a health summary email to -personnel in charge. For that, click Notification settings, then follow the steps described in the -[Notifications](/docs/auditor/10.9/admin/settings/notifications.md) topic. +personnel in charge. To do that, click Notification settings, then follow the steps in the +[Notifications](/docs/auditor/10.9/admin/settings/notifications/notifications.md) topic. diff --git a/docs/auditor/10.9/admin/healthstatus/summaryemail.md b/docs/auditor/10.9/admin/healthstatus/summaryemail.md index 87953b0469..6ccfbbfb17 100644 --- a/docs/auditor/10.9/admin/healthstatus/summaryemail.md +++ b/docs/auditor/10.9/admin/healthstatus/summaryemail.md @@ -8,13 +8,13 @@ sidebar_position: 30 Auditor Health Summary email includes all statistics on the product operations and health for the last 24 hours; it also notifies you about license status. By default, Auditor generates this email -daily at 7:00 AM and delivers it to the recipient specified in the -[Notifications](/docs/auditor/10.9/admin/settings/notifications.md) settings. Email content is very similar to data -presented in the [Health Status Dashboard](/docs/auditor/10.9/admin/healthstatus/dashboard/overview.md). +daily at 7:00 AM and delivers it to the recipient you specify in the +[Notifications](/docs/auditor/10.9/admin/settings/notifications/notifications.md) settings. Email content is similar to the data in +the [Health Status Dashboard](/docs/auditor/10.9/admin/healthstatus/dashboard/overview.md). -For greater usability, to depict overall product health state, the email includes a color indicator +To show overall product health state, the email includes a color indicator in the topmost section: green means Auditor had no issues while auditing your IT infrastructure, and -red means there were some problems that require your attention. +red means problems require your attention. The following example shows what the email looks like: diff --git a/docs/auditor/10.9/admin/monitoringplans/activitysummaryemail.md b/docs/auditor/10.9/admin/monitoringplans/activitysummaryemail.md index 0e7753bdea..5e82790afb 100644 --- a/docs/auditor/10.9/admin/monitoringplans/activitysummaryemail.md +++ b/docs/auditor/10.9/admin/monitoringplans/activitysummaryemail.md @@ -8,11 +8,11 @@ sidebar_position: 220 Netwrix Auditor automatically generates the Activity Summary email, which lists all changes / recorded user sessions that occurred since the last Activity Summary delivery. By default, for most -data sources Netwrix Auditor generates an Activity Summary daily at 3:00 AM and delivers it to the specified -recipients. You can also launch data collection and Activity Summary generation manually. +data sources Netwrix Auditor generates an Activity Summary daily at 3:00 AM and delivers it to the +recipients you specify. You can also launch data collection and Activity Summary generation manually. -Notifications on user activity and event log collection (Event Log Collection Status) are a bit -different and don't show changes. +Notifications on user activity and event log collection (Event Log Collection Status) differ +slightly and don't show changes. The following Activity Summary example applies to Active Directory. Other Activity Summaries that Netwrix Auditor generates and delivers vary slightly depending on the data source. @@ -23,19 +23,19 @@ The example Activity Summary provides the following information on Active Direct | Column | Description | | ----------- | ------------------------------------------------------------------------------------------------------------------- | -| Action | Shows the type of action that was performed on the object. - Added - Removed - Modified - Activated (User Activity) | +| Action | Shows the type of action performed on the object. - Added - Removed - Modified - Activated (User Activity) | | Object Type | Shows the type of the modified AD object, for example, 'user'. | | What | Shows the path to the modified AD object. | | Item | Shows the item associated with the selected monitoring plan. | -| Where | Shows the name of the domain controller where the change was made. | -| Who | Shows the name of the account under which the change was made. | +| Where | Shows the name of the domain controller where the change occurred. | +| Who | Shows the name of the account that made the change. | | When | Shows the exact time when the change occurred. | -| Workstation | Shows the name / IP address of the computer where the user was logged on when the change was made. | +| Workstation | Shows the name / IP address of the computer where the user was logged on when the change occurred. | | Details | Shows the before and after values of the modified AD object. | To initiate an on-demand Activity Summary delivery, navigate to the Monitoring Plans section, select -a plan, click Edit, and then select Update. Netwrix Auditor delivers a summary to the specified -recipient, listing all activity that occurred since the last data collection. +a plan, click Edit, and then select Update. Netwrix Auditor delivers a summary to the recipient you +specified, listing all activity that occurred since the last data collection. To disable Activity Summary Emails, you need to disable notifications in the settings. See the -[Notifications](/docs/auditor/10.9/admin/settings/notifications.md) topic for additional information. +[Notifications](/docs/auditor/10.9/admin/settings/notifications/notifications.md) topic for additional information. diff --git a/docs/auditor/10.9/admin/monitoringplans/azurefiles.md b/docs/auditor/10.9/admin/monitoringplans/azurefiles.md index 4706d48130..43c3e9e421 100644 --- a/docs/auditor/10.9/admin/monitoringplans/azurefiles.md +++ b/docs/auditor/10.9/admin/monitoringplans/azurefiles.md @@ -23,7 +23,7 @@ Create monitoring plans for Azure Files to track file and folder changes across 2. Select **Azure Files** 3. Configure: - [Audit database (SQL)](/docs/auditor/10_9/admin/settings/auditdatabase) - - [Notifications (SMTP or Exchange Online)](/docs/auditor/10_9/admin/settings/notifications) + - [Notifications (SMTP or Exchange Online)](/docs/auditor/10.9/admin/settings/notifications/notifications.md) - Plan name and description - Select **Add item now** diff --git a/docs/auditor/10.9/admin/monitoringplans/create.md b/docs/auditor/10.9/admin/monitoringplans/create.md index 49cd8d3088..467d799e90 100644 --- a/docs/auditor/10.9/admin/monitoringplans/create.md +++ b/docs/auditor/10.9/admin/monitoringplans/create.md @@ -44,16 +44,16 @@ general settings for data collection. | Option | Description | | --------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| Specify the account for collecting data | If applicable, you can create a data collecting account in the following ways: - Not specified – Select this option if you want to choose the Netwrix Privilege Secure as the data collecting account for the Monitoring Plan. See the [Netwrix Privilege Secure](/docs/auditor/10.9/admin/settings/privilegesecure.md) topic for additional information. - User/password – Provide a username and password for the account that Auditor will use to collect data. By default, the user name is prepopulated with your account name. - gMSA – Use the group Managed Service Account (gMSA) as data collecting account. For more details about gMSA usage, see the [Use Group Managed Service Account (gMSA)](/docs/auditor/10.9/requirements/gmsa.md) topic. **NOTE:** If you want to audit network devices or Microsoft Entra ID (formerly Azure AD)/Office 365 infrastructure, you need to use _not specified_ account. Ensure the account has sufficient permissions to collect data. For a full list of the rights and permissions, and instructions on how to configure them, refer to the[Data Collecting Account](/docs/auditor/10.9/admin/monitoringplans/dataaccounts.md). Netwrix recommends creating a special service account with extended permissions. When you configure a monitoring plan for the first time, the account you specify for data collection will be set as default. | -| Enable network traffic compression | If selected, this option instructs Auditor to deploy a special utility that will run on the audited computers and do the following: - Collect and pre-filter audit data - Compress data and forward it to Auditor Server. This approach helps to optimize load balance and reduce network traffic. So, using this option can be recommended especially for distributed networks with remote locations that have limited bandwidth. See the [Network Traffic Compression](/docs/auditor/10.9/admin/healthstatus/networktrafficcompression.md) topic for additional information. | -| Adjust audit settings automatically | Auditor can configure audit settings in your environment automatically. Select Adjust audit settings automatically. In this case, Auditor will continually check and enforce the relevant audit policies. For some data sources (Active Directory and Logon Activity) you will be offered to launch a special utility that will detect current audit settings, check them against requirements and then adjust them automatically. See the [Audit Configuration Assistant](/docs/auditor/10.9/tools/auditconfigurationassistant.md) topic for additional information. You may also want to apply audit settings via GPO (for example, for Windows Servers). Auditor has certain limitations when configuring audit settings for NetApp and Dell Data Storage. See the [File Servers](/docs/auditor/10.9/admin/monitoringplans/fileservers/overview.md) topic for additional information. If any conflicts are detected with your current settings, automatic audit configuration will not be performed. Select this option if you want to audit file shares on NetApp Data ONTAP 7 and 8 in 7-mode. For NetApp Clustered Data ONTAP 8 and ONTAP 9, only audit settings for file shares can be configured automatically, other settings must be applied manually. If you plan to monitor EMC Isilon, clear the checkbox. Auditor can't configure audit on Dell Isilon appliances automatically. If you want to audit Dell VNX/VNXe, select Adjust audit settings automatically, but only audit settings for file shares will configured, the rest of settings must be configured manually. For a full list of audit settings and instructions on how to configure them manually, see the [Supported Data Sources](/docs/auditor/10.9/requirements/supporteddatasources/supporteddatasources.md) for additional information. | +| Specify the account for collecting data | If applicable, you can create a data collecting account in the following ways: - Not specified – Select this option if you want to choose the Netwrix Privilege Secure as the data collecting account for the Monitoring Plan. See the [Netwrix Privilege Secure](/docs/auditor/10.9/admin/settings/privilegesecure.md) topic for additional information. - User/password – Provide a username and password for the account that Auditor will use to collect data. By default, Auditor prepopulates the user name with your account name. - gMSA – Use the group Managed Service Account (gMSA) as data collecting account. For more details about gMSA usage, see the [Use Group Managed Service Account (gMSA)](/docs/auditor/10.9/requirements/gmsa.md) topic. **NOTE:** If you want to audit network devices or Microsoft Entra ID (formerly Azure AD)/Office 365 infrastructure, you need to use _not specified_ account. Ensure the account has sufficient permissions to collect data. For a full list of the rights and permissions, and instructions on how to configure them, refer to the[Data Collecting Account](/docs/auditor/10.9/admin/monitoringplans/dataaccounts.md). Netwrix recommends creating a special service account with extended permissions. When you configure a monitoring plan for the first time, Auditor sets the account you specify for data collection as the default. | +| Enable network traffic compression | If you select this option, Auditor deploys a special utility that runs on the audited computers and does the following: - Collect and pre-filter audit data - Compress data and forward it to Auditor Server. This approach helps to optimize load balance and reduce network traffic. Netwrix especially recommends this option for distributed networks with remote locations that have limited bandwidth. See the [Network Traffic Compression](/docs/auditor/10.9/admin/healthstatus/networktrafficcompression.md) topic for additional information. | +| Adjust audit settings automatically | Auditor can configure audit settings in your environment automatically. Select Adjust audit settings automatically. In this case, Auditor will continually check and enforce the relevant audit policies. For some data sources (Active Directory and Logon Activity), Auditor offers to launch a special utility that detects current audit settings, checks them against requirements, and then adjusts them automatically. See the [Audit Configuration Assistant](/docs/auditor/10.9/tools/auditconfigurationassistant.md) topic for additional information. You may also want to apply audit settings via GPO (for example, for Windows Servers). Auditor has certain limitations when configuring audit settings for NetApp and Dell Data Storage. See the [File Servers](/docs/auditor/10.9/admin/monitoringplans/fileservers/overview.md) topic for additional information. If Auditor detects any conflicts with your current settings, it doesn't perform automatic audit configuration. Select this option if you want to audit file shares on NetApp Data ONTAP 7 and 8 in 7-mode. For NetApp Clustered Data ONTAP 8 and ONTAP 9, Auditor can configure only audit settings for file shares automatically; you must apply other settings manually. If you plan to monitor EMC Isilon, clear the checkbox. Auditor can't configure audit on Dell Isilon appliances automatically. If you want to audit Dell VNX/VNXe, select Adjust audit settings automatically, but Auditor configures only audit settings for file shares; you must configure the rest manually. For a full list of audit settings and instructions on how to configure them manually, see the [Supported Data Sources](/docs/auditor/10.9/requirements/supporteddatasources/supporteddatasources.md) for additional information. | | Launch Audit Configuration Assistant | Click to launch a specially intended utility that will assess your environment readiness for monitoring and adjust audit settings, if necessary. The tool will be launched in a new window. See the [Audit Configuration Assistant](/docs/auditor/10.9/tools/auditconfigurationassistant.md) topic for additional information. | -| Collect data for state-in-time reports | State-in-time reports are based on the daily configuration snapshots of your audited systems; they help you to analyze particular aspects of the environment. State-in-time configuration snapshots are also used for IT risks assessment metrics and reports. This data collection option is available if you are creating a monitoring plan for any of the following data sources: - Active Directory - File Servers - Windows Server - Group Policy - SharePoint - SharePoint Online - Exchange Online - SQL Server - VMware See the [State–In–Time Reports](/docs/auditor/10.9/admin/reports/types/stateintime/overview.md) and [IT Risk Assessment Overview ](/docs/auditor/10.9/admin/riskassessment/overview.md) topics for additional information. | +| Collect data for state-in-time reports | State-in-time reports are based on the daily configuration snapshots of your audited systems; they help you to analyze particular aspects of the environment. Netwrix Auditor also uses state-in-time configuration snapshots for IT risks assessment metrics and reports. This data collection option is available if you are creating a monitoring plan for any of the following data sources: - Active Directory - File Servers - Windows Server - Group Policy - SharePoint - SharePoint Online - Exchange Online - SQL Server - VMware See the [State–In–Time Reports](/docs/auditor/10.9/admin/reports/types/stateintime/overview.md) and [IT Risk Assessment Overview ](/docs/auditor/10.9/admin/riskassessment/overview.md) topics for additional information. | ## Default SQL Server Instance -To provide searching, alerting, and reporting capabilities, Auditor needs an SQL Server where audit -data will be stored in the databases. To store data from the data sources included in the monitoring +To provide searching, alerting, and reporting capabilities, Auditor needs an SQL Server where it can +store audit data in the databases. To store data from the data sources included in the monitoring plan, the wizard creates an Audit Database for each plan. At this step, you should specify the default SQL Server instance that will host Auditor databases. See the [Requirements for SQL Server to Store Audit Data](/docs/auditor/10.9/requirements/sqlserver.md) topic for @@ -61,7 +61,7 @@ additional information. Alternatively, you can instruct Auditor not to store data to the databases but only to the repository (Long-Term Archive) – in this scenario, you will only be able to receive activity -summaries. Reporting and alerting capabilities will not be provided. +summaries. Auditor doesn't provide reporting and alerting capabilities. Auditor skips this step if you have already configured Audit Database settings for other monitoring plans. @@ -69,18 +69,18 @@ plans. Select one of the following options: - Disable security intelligence and make data available only in activity summaries — select this - option if you don't want audit data to be written to the Audit Database. In this case, data will - be available only in Activity Summary emails. Alerts, reports, and search capabilities will not be - supported. + option if you don't want Auditor to write audit data to the Audit Database. In this case, data is + available only in Activity Summary emails. Auditor doesn't support alerts, reports, and search + capabilities. If you later clear this option to start saving data to the database, Auditor will not import already collected audit data into that database. - Install a new instance of Microsoft SQL Server Express automatically — this option is available at the first run of the wizard. This option lets you deploy SQL Server 2016 SP2 Express with Advanced - Services on the local machine. This SQL Server will be used as default host for Auditor databases. + Services on the local machine. Auditor uses this SQL Server as the default host for its databases. - It is strongly recommended that you plan for your databases first, as described in + Netwrix strongly recommends planning your databases first, as described in the [Requirements for SQL Server to Store Audit Data](/docs/auditor/10.9/requirements/sqlserver.md) section. Remember that database size in SQL Server Express edition may be insufficient for your audited infrastructure. @@ -94,9 +94,9 @@ Select one of the following options: | Option | Description | | ------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | - | SQL Server instance | Specify the name of the SQL Server instance to store audit data. If you have more than one Auditor Server running in your network, ensure to configure them to use different SQL Server instances. The same SQL Server instance can't be used to store audit data collected by several Auditor Servers. | + | SQL Server instance | Specify the name of the SQL Server instance to store audit data. If you have more than one Auditor Server running in your network, ensure to configure them to use different SQL Server instances. Several Auditor Servers can't share the same SQL Server instance for storing audit data. | | Authentication | Select the authentication type you want to use to connect to the SQL Server instance: - Windows authentication - SQL Server authentication | - | User name | Specify the account to be used to connect to the SQL Server instance. This account must be granted the **database owner (db_owner)** role and the dbcreator server role. | + | User name | Specify the account to use when connecting to the SQL Server instance. This account must have the **database owner (db_owner)** role and the dbcreator server role. | | Password | Enter a password. | **NOTE:** If you want to use Group Managed Service Account (gMSA) to access the SQL Server @@ -121,8 +121,8 @@ Configure the following: | Setting | Description | | ------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -| Disable security intelligence ... | Only select this option if you don't want your data to be stored in the database. In this case, you will only be able to receive activity summaries. Reporting and alerting capabilities will not be provided. To store data to the database, leave this checkbox cleared. | -| Database | Default database name is _Netwrix_Auditor_``_. It is recommended that you enter a meaningful name for the database here. It may include the data source type (e.g. \_Exchange_Audit_Data_ or _OracleSrv02_Audit_Data_), or so. If you decided to use the existing SQL Server instance instead of dedicated, you may want to use _Netwrix_Auditor_ prefix to distinguish Netwrix Auditor databases from others. | +| Disable security intelligence ... | Only select this option if you don't want Auditor to store your data in the database. In this case, you will only be able to receive activity summaries. Auditor doesn't provide reporting and alerting capabilities. To store data to the database, leave this checkbox cleared. | +| Database | Default database name is _Netwrix_Auditor_``_. Netwrix recommends entering a meaningful name for the database here. It may include the data source type (e.g. \_Exchange_Audit_Data_ or _OracleSrv02_Audit_Data_), or so. If you decided to use the existing SQL Server instance instead of dedicated, you may want to use _Netwrix_Auditor_ prefix to distinguish Netwrix Auditor databases from others. | | Use default SQL Server settings | Select this option if you want Auditor to connect to the SQL Server instance using the default settings you specified at the Default SQL Server Instance step. | | Specify custom connection parameters | Select this option to use custom credentials when connecting to SQL Server. Specify authentication method and the account that Auditor will use. Ensure this account has sufficient rights to connect to SQL Server and work with the databases. | @@ -135,10 +135,10 @@ server used for reporting) are available on the Audit Database page of Auditor s ## SMTP Server Settings -When you create the first monitoring plan, Auditor prompts you to specify the email settings that -will be used for activity and health summaries, reports, and alerts delivery. For the monitoring plans +When you create the first monitoring plan, Auditor prompts you to specify the email settings it +uses for activity and health summaries, reports, and alert delivery. For the monitoring plans that follow, Netwrix Auditor will automatically detect SMTP settings; however, for your first plan -you should provide them manually. See the [Notifications](/docs/auditor/10.9/admin/settings/notifications.md) topic for +you should provide them manually. See the [Notifications](/docs/auditor/10.9/admin/settings/notifications/notifications.md) topic for additional information. You can skip this step if you don't want to receive email notifications, or configure SMTP settings diff --git a/docs/auditor/10.9/admin/navigation/recommendations.md b/docs/auditor/10.9/admin/navigation/recommendations.md index b51768d695..09b23794db 100644 --- a/docs/auditor/10.9/admin/navigation/recommendations.md +++ b/docs/auditor/10.9/admin/navigation/recommendations.md @@ -9,12 +9,12 @@ sidebar_position: 10 This section covers the Recommendations interface that contains detailed guidance on the Auditor usage patterns. After you install the product, configure your IT infrastructure, and prepare Netwrix Service Accounts, you can start collecting data and review it with Netwrix Auditor. The -recommendations are based on your current product configuration and help you to experience the -Auditor capabilities in earnest. +recommendations are based on your current product configuration and help you make full use of the +Auditor capabilities. ![recommendations](/images/auditor/10.9/admin/navigation/recommendations.webp) -To review the recommendations provided by Netwrix industry experts: +To review the recommendations from Netwrix industry experts: **Step 1 –** On the Auditor home page, click the **Recommendations** tile. @@ -22,7 +22,7 @@ To review the recommendations provided by Netwrix industry experts: required steps. After you complete the required steps, the recommendation moves to the '**Complete**' list. You can move -it back to the active state any time you want by clicking the **Move to active** link. +it back to the active state at any time by clicking the **Move to active** link. ## Available Recommendations @@ -42,15 +42,15 @@ automatically suggests item types associated with your data source. ### Start Abandoned Data Source Auditing If you have a license for several applications, Netwrix suggests enabling each undeployed data -source for each purchased application if they were never deployed before. Clicking the **Add plan** +source for each purchased application. Clicking the **Add plan** button opens the New Monitoring Plan wizard. Select the data source you want to monitor with Netwrix Auditor and see the [Create a New Plan](/docs/auditor/10.9/admin/monitoringplans/create.md) topic for additional information about further configuration. ### Enable State-in-Time Data Collection -If you want to review the state of your system configuration at a specific moment in time, for -example, account permissions or group membership, you need to enable the State-in-Time data +If you want to review the state of your system configuration — for example, account permissions or +group membership — at a specific moment in time, you need to enable the State-in-Time data collection for your data source. See the [State–in–Time Reports](/docs/auditor/10.9/admin/reports/types/stateintime/overview.md) topic for additional information about the available reports. Clicking the **Go to data source** button opens the settings page of @@ -65,12 +65,12 @@ data source and check the state-in-time data collection settings manually. The Health Summary email includes all statistics on the product operations and health for the last 24 hours; it also notifies you about license status. If you have configured monitoring plans with -data sources and items, Netwrix recommends subscribing to Health Summary emails to be notified on -the problems that need your attention. See the +data sources and items, Netwrix recommends subscribing to Health Summary emails to learn about +problems that need your attention. See the [Health Summary Email](/docs/auditor/10.9/admin/healthstatus/summaryemail.md) topic for additional information. Clicking the **Go to Notifications** button opens the Netwrix Auditor notifications settings page. -See the [Notifications](/docs/auditor/10.9/admin/settings/notifications.md) topic for additional information. +See the [Notifications](/docs/auditor/10.9/admin/settings/notifications/notifications.md) topic for additional information. ### Logon Activity: Start Auditing Item @@ -84,8 +84,8 @@ configuration. ### Enable Alerts -For the configured monitoring plans, Netwrix recommends enabling alerts to be immediately notified -on the suspicious activity. You can enable predefined alerts or create your custom ones. +For the configured monitoring plans, Netwrix recommends enabling alerts to receive immediate +notifications about suspicious activity. You can enable predefined alerts or create your custom ones. Clicking the **Open** settings button opens the All Alerts wizard. See the [Manage Alerts](/docs/auditor/10.9/admin/alertsettings/overview.md) topic for additional information. @@ -96,7 +96,7 @@ For active recommendations, you can follow the prompts or move them to the compl clicking the '**Mark as complete**' link. For completed recommendations, you can configure the retention period to keep them visible and -select their categories for further displaying on the tile. If you want to proceed with a completed +select their categories for display on the tile. If you want to proceed with a completed recommendation, click the '**Move to active**' link below the recommendation. To manage recommendations: @@ -111,9 +111,9 @@ To manage recommendations: - Keep completed recommendations: `<30>` days – Specify time period in days to keep the completed recommendations visible. The default period is set to 30 days. -- Select the recommendations to fine-tune product configuration – Select recommendations types you - want to be displayed. When checked, the recommendations of the selected type appear once your - Auditor configuration meets the recommendation conditions. +- Select the recommendations to fine-tune product configuration – Select the recommendation types + you want to display. When you check a type, its recommendations appear once your Auditor + configuration meets the recommendation conditions. For example, if you selected the 'Enable State-in-Time data collection', this recommendation appears for each new monitoring plan with disabled state-in-time option. diff --git a/docs/auditor/10.9/admin/settings/notifications.md b/docs/auditor/10.9/admin/settings/notifications.md deleted file mode 100644 index 8e8a476a6a..0000000000 --- a/docs/auditor/10.9/admin/settings/notifications.md +++ /dev/null @@ -1,156 +0,0 @@ ---- -title: "Notifications" -description: "Notifications" -sidebar_position: 50 ---- - -# Notifications - -You configure notification settings when you create the first monitoring plan in the New monitoring -plan wizard. - -You can update notification settings at any time in the **Settings > Notifications**. To disable -notifications, go to **Settings > Notifications > Modify** and select **No notifications** options. - -Review the following for additional information: - -- Enable Notifications via Exchange Online -- Enable Notifications via SMTP -- Summary Emails and Notifications about Critical Events - -## Enable Notifications via Exchange Online - -To enable Netwrix Auditor to send email notifications via Exchange Online using modern -authentication, configure an application. To do this, follow these steps. - -**Step 1 –** Register a new application in the Microsoft Entra admin center. - -**Step 1 –** Under Identity go to **Applications > App registrations** and choose **New -registration**. - -**Step 2 –** Enter the name for your application, choose "Accounts in this organizational directory -only". Redirect URL is optional. - -**Step 3 –** Save Client ID and Tenant ID. - -**Step 4 –** Create a new client secret and save it. - -**Step 5 –** Under Microsoft Graph API, go to **Manage** **>** **API permissions**, and perform the -following steps: - -1. Click **Add** -2. In the Request API permissions window, click **Microsoft Graph**. -3. Select **Application Permissions**. -4. In the search box, type Mail.ReadWrite and Mail.Send to add these permissions to the application. - -**Step 6 –** Grant admin consent for these permissions. - -**Step 7 –** In Netwrix Auditor, go to Notification Settings, click Modify, and under Exchange -Online enter Tenant name, Application ID and Application secret. - -After the application configuration, you can restrict permission so only the specified accounts -could use the application to send email. To do this, the following actions required: - -- Create a Group -- Add Email to a Group -- Apply Restriction Using PowerShell Commands - -### Create a Group - -To create a group: - -**Step 1 –** Log in to the Exchange admin center with your administrator account. - -**Step 2 –** Under Groups click the **Mail-enabled security** tab. - -**Step 3 –** Click **Add a group**. - -**Step 4 –** Select **Mail-enabled security** and click **Next**. - -**Step 5 –** Set a name and click **Next**. - -**Step 6 –** Set group name and select **Approval**. Its needed to require owner approval to join -the group. - -**Step 7 –** Click **Next**. - -**Step 8 –** Click **Create**. - -### Add Email to a Group - -To add emails to a group: - -**Step 1 –** In the Exchange admin center go to Groups and click the [Mail-enabled security] tab. - -**Step 2 –** Click the group you have created and add emails you want to allow APIs to access. - -### Apply Restriction Using PowerShell Commands - -To run the following commands using PowerShell: - -**Step 1 –** Open PowerShell - -**Step 2 –** Run the following commands in order: - -``` -Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Run: Install-Module PowerShellGet -Force -Install-Module -Name ExchangeOnlineManagement -Force -Get-Module ExchangeOnlineManagement -Connect-ExchangeOnline -UserPrincipalName {ADMIN_EMAIL_ADDRESS_HERE} -``` - -**Step 3 –** Sign in as Admin in the pop-up window. - -**Step 4 –** Run the following command: - -``` -New-ApplicationAccessPolicy  --AppId {APPLICATION_ID_HERE}  --PolicyScopeGroupId {GROUP_EMAIL_ADDRESS_HERE}  --AccessRight RestrictAccess  --Description "YOUR DESCRIPTION HERE." -``` - -## Enable Notifications via SMTP - -To enable notifications via SMTP, first select **SMTP** in the **Method** column, then navigate to -the following Default SMTP settings to review settings used to deliver email notifications, reports, etc., -and click Modify to adjust them if necessary. - -| Option | Description | -| ------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| SMTP server | Enter your SMTP server address. It can be your company's Exchange server or any public mail server (e.g., Gmail, Yahoo). | -| Port number | Specify your SMTP server port number. | -| Sender address | Enter the address that will appear in the From field. **_RECOMMENDED:_** click **Send Test Email**. The system will send a test message to the specified email address and inform you if any problems are detected. | -| SMTP authentication | Select this checkbox if your mail server requires the SMTP authentication. | -| Sender email (from) | Enter the address that will appear in the "_From_" field in email notifications. This option doesn't affect notifications sent to users' managers and administrators. Before configuring the "_From_" field for user email notifications, ensure that your Exchange supports this option. | -| User name | Enter a user name for the SMTP authentication. | -| Password | Enter a password for SMTP authentication. | -| Use Secure Sockets Layer encrypted connection (SSL/TLS) | Select this checkbox if your SMTP server requires SSL to be enabled. | -| Use implicit SSL authentication | Select this checkbox to use implicit SSL mode, which establishes an SSL connection before sending any meaningful data. | -| Enforce certificate validation to ensure security | Select this checkbox if you want to verify security certificate on every email transmission. The option isn't available for auditing User Activity as well Netwrix Auditor tools. | - -You can configure Activity Summary frequency, format, and delivery time for each monitoring plan -individually. See the [Fine-Tune Your Plan and Edit Settings](/docs/auditor/10.9/admin/monitoringplans/finetune.md) topic -for more information. - -After that, you can specify the recipient who will receive product activity and health summary -emails. - -## Summary Emails and Notifications about Critical Events - -To send summary emails and notifications about critical events: - -**Step 1 –** Navigate to the Summary email recipient and click Modify. - -**Step 2 –** Specify recipient address: - -- To send to a single recipient, enter personal mailbox address. -- To send to multiple recipients, add them to a distribution group, and enter the - group address. Entering multiple individual addresses isn't supported. - -For more information about product health, you can also navigate to the Health status tile in the main -window. It will take you to the Health Status dashboard that contains information on the product -activity and system health state. See the -[Health Status Dashboard](/docs/auditor/10.9/admin/healthstatus/dashboard/overview.md) topic for additional information. diff --git a/docs/auditor/10.9/admin/settings/notifications/_category_.json b/docs/auditor/10.9/admin/settings/notifications/_category_.json new file mode 100644 index 0000000000..6dbc1e5989 --- /dev/null +++ b/docs/auditor/10.9/admin/settings/notifications/_category_.json @@ -0,0 +1,6 @@ +{ + "label": "Notifications", + "position": 50, + "collapsed": true, + "collapsible": true +} diff --git a/docs/auditor/10.9/admin/settings/notifications/exchangeonline.md b/docs/auditor/10.9/admin/settings/notifications/exchangeonline.md new file mode 100644 index 0000000000..6a41a8e2ea --- /dev/null +++ b/docs/auditor/10.9/admin/settings/notifications/exchangeonline.md @@ -0,0 +1,130 @@ +--- +title: "Enable Notifications via Exchange Online" +description: "Enable Notifications via Exchange Online" +sidebar_position: 20 +--- + +# Enable Notifications via Exchange Online + +To enable Netwrix Auditor to send email notifications via Exchange Online using modern +authentication (OAuth 2.0 client credentials flow), register an application in Microsoft Entra ID +and grant it permission to send mail on behalf of a mailbox. + +## Step 1 — Register an Application + +**Step 1 –** In the Microsoft Entra admin center, under **Identity**, go to **Applications > App +registrations** and click **New registration**. + +**Step 2 –** Enter a name for your application and choose **Accounts in this organizational +directory only**. The redirect URI is optional; Netwrix Auditor doesn't use it. + +**Step 3 –** Save the **Application (client) ID** and **Directory (tenant) ID** — you will need +them when configuring Netwrix Auditor as **Application ID** and **Tenant name**, respectively. + +**Step 4 –** Under **Certificates & secrets**, create a new client secret and save its value +immediately — you can't view it again after you leave the page. + +## Step 2 — Grant API Permissions + +**Step 1 –** Under **Manage > API permissions**, click **Add a permission > Microsoft Graph > +Application permissions**. + +**Step 2 –** Add the following **Application** permissions: + +| Permission | Why it is required | +| -------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| `Mail.Send` | Required to send a message directly (`POST /users/{id}/sendMail`). This covers every notification and report attachment up to 3 MB. | +| `Mail.ReadWrite` | Required only for attachments larger than 3 MB. In that case Netwrix Auditor creates a draft message, uploads the attachment in chunks via an upload session, sends the draft, and deletes it — all of which operate on the `messages` resource and require `Mail.ReadWrite` in addition to `Mail.Send`. | + +**Step 3 –** Click **Grant admin consent for <your organization>**. Application permissions +take effect only after admin consent — without it, sending will fail with an authorization error. + +## Step 3 — Configure Notification Settings in Netwrix Auditor + +**Step 1 –** In Netwrix Auditor, go to **Settings > Notifications**, select **Exchange Online** in +the **Method** column, and click **Modify**. + +**Step 2 –** Fill in the following fields: + +| Field | Description | +| -------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| Tenant name | Your Microsoft Entra primary domain name. | +| Application ID | The Application (client) ID saved in Step 1. | +| Application secret | The client secret value saved in Step 1. | +| Tenant environment | The Microsoft cloud environment your tenant belongs to. Select **Default** unless your organization uses a national/sovereign cloud (see [Tenant Environment Options](#tenant-environment-options)). This determines which login and Graph API endpoints Netwrix Auditor uses to authenticate and send mail. | +| Sender address | The mailbox Netwrix Auditor sends email from. This mailbox must exist in the tenant, and the application must have permission to act on its behalf (see [Restrict Application Access](#restrict-application-access-optional)). | + +### Tenant Environment Options + +Select the option matching your organization's Microsoft cloud. Using the wrong option will cause +authentication or sending to fail, because each cloud has its own login and Graph API endpoints +that aren't interchangeable with the commercial cloud. + +| Tenant environment | Login endpoint | Graph API endpoint | +| ------------------------------ | ------------------------------- | --------------------------------- | +| Default (commercial/global) | `login.microsoftonline.com` | `graph.microsoft.com` | +| US Government (GCC) | `login.microsoftonline.com` | `graph.microsoft.com` | +| US Government L4 (GCC High) | `login.microsoftonline.us` | `graph.microsoft.us` | +| US Government L5 (DoD) | `login.microsoftonline.us` | `dod-graph.microsoft.us` | +| China | `login.chinacloudapi.cn` | `microsoftgraph.chinacloudapi.cn` | + +:::note +US Government (GCC) uses the same endpoints as the commercial cloud — select it only if you need +to keep the setting explicit for your organization's records; functionally it behaves like +**Default**. **GCC High** and **DoD** use dedicated `*.us` endpoints, and **China** uses dedicated +`*.cn` endpoints — you must register the application in the corresponding Microsoft Entra +environment for these to work. +::: + +## Restrict Application Access (Optional) + +By default, once it has `Mail.Send`/`Mail.ReadWrite`, the application can send mail as **any** +mailbox in the tenant. To restrict it to one or a few specific mailboxes, apply an Exchange Online +application access policy. + +### Create a Mail-Enabled Security Group + +**Step 1 –** Sign in to the Exchange admin center with an administrator account. + +**Step 2 –** Under **Groups**, open the **Mail-enabled security** tab and click **Add a group**. + +**Step 3 –** Select **Mail-enabled security** and click **Next**. + +**Step 4 –** Set a name and description, then click **Next**. + +**Step 5 –** Choose whether joining the group requires owner approval, then click **Next**. + +**Step 6 –** Review the settings and click **Create**. + +### Add the Sender Mailbox to the Group + +**Step 1 –** In the Exchange admin center, go to **Groups > Mail-enabled security**. + +**Step 2 –** Open the group you created and add the mailboxes the application can send from — +these should include the **Sender address** you configured in Netwrix Auditor. + +### Apply the Access Policy via PowerShell + +**Step 1 –** Open PowerShell as an administrator and run: + +```powershell +Set-ExecutionPolicy -ExecutionPolicy RemoteSigned +Install-Module -Name ExchangeOnlineManagement -Force +Import-Module ExchangeOnlineManagement +Connect-ExchangeOnline -UserPrincipalName {ADMIN_EMAIL_ADDRESS_HERE} +``` + +**Step 2 –** Sign in as an administrator in the pop-up window when prompted. + +**Step 3 –** Create the access policy, scoping the application to the group you created: + +```powershell +New-ApplicationAccessPolicy ` + -AppId {APPLICATION_ID_HERE} ` + -PolicyScopeGroupId {GROUP_EMAIL_ADDRESS_HERE} ` + -AccessRight RestrictAccess ` + -Description "Restrict Netwrix Auditor notification app to the notifications mailbox." +``` + +Replace `{APPLICATION_ID_HERE}` with the Application (client) ID from Step 1 and +`{GROUP_EMAIL_ADDRESS_HERE}` with the group's email address. diff --git a/docs/auditor/10.9/admin/settings/notifications/notifications.md b/docs/auditor/10.9/admin/settings/notifications/notifications.md new file mode 100644 index 0000000000..1e190a39cb --- /dev/null +++ b/docs/auditor/10.9/admin/settings/notifications/notifications.md @@ -0,0 +1,40 @@ +--- +title: "Notifications" +description: "Notifications" +sidebar_position: 10 +--- + +# Notifications + +You configure notification settings when you create the first monitoring plan in the New +monitoring plan wizard. + +You can update notification settings at any time in **Settings > Notifications**. To disable +notifications, go to **Settings > Notifications > Modify** and select the **No notifications** +option. + +Netwrix Auditor can deliver email notifications, reports, and activity summaries using either of +two delivery methods. Select the method in the **Method** column: + +- [Enable Notifications via Exchange Online](/docs/auditor/10.9/admin/settings/notifications/exchangeonline.md) — + modern (OAuth 2.0) authentication against Exchange Online / Microsoft 365, including national + cloud (GCC, GCC High, DoD, China) support. +- [Enable Notifications via SMTP](/docs/auditor/10.9/admin/settings/notifications/smtp.md) — + traditional SMTP delivery to any SMTP server, on-premises Exchange, or public mail provider. + +## Activity and Health Summary Email + +Configure the recipient for summary emails and notifications about critical events. + +**Step 1 –** Navigate to the Summary email recipient and click **Modify**. + +**Step 2 –** Specify the recipient address: + +- To send to a single recipient, enter a personal mailbox address. +- To send to multiple recipients, add them to a distribution group, and enter the group address. + Netwrix Auditor doesn't support entering multiple individual addresses. + +The Health status tile in the main window opens the Health Status dashboard, which contains +information on product activity and system health state. See the +[Health Status Dashboard](/docs/auditor/10.9/admin/healthstatus/dashboard/overview.md) topic for +additional information. diff --git a/docs/auditor/10.9/admin/settings/notifications/smtp.md b/docs/auditor/10.9/admin/settings/notifications/smtp.md new file mode 100644 index 0000000000..ba29e7ff5a --- /dev/null +++ b/docs/auditor/10.9/admin/settings/notifications/smtp.md @@ -0,0 +1,27 @@ +--- +title: "Enable Notifications via SMTP" +description: "Enable Notifications via SMTP" +sidebar_position: 30 +--- + +# Enable Notifications via SMTP + +To enable notifications via SMTP, go to **Settings > Notifications**, select **SMTP** in the +**Method** column, and click **Modify** next to **Default SMTP settings** to review and adjust +the settings Netwrix Auditor uses to deliver email notifications, reports, and other messages. + +| Option | Description | +| ------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| SMTP server | Enter your SMTP server address. It can be your company's Exchange server or any public mail server (e.g., Gmail, Yahoo). | +| Port number | Specify your SMTP server port number. Valid range is 1–65535. | +| Sender address | Enter the address that will appear in the "From" field. **_RECOMMENDED:_** click **Send Test Email**. The system will send a test message to the specified email address and inform you if it detects any problems. | +| SMTP authentication | Select this checkbox if your mail server requires SMTP authentication. When you select it, specify the **User name** and **Password**. | +| User name | Enter a user name for SMTP authentication. Available only when **SMTP authentication** is selected. | +| Password | Enter a password for SMTP authentication. Available only when **SMTP authentication** is selected. | +| Use Secure Sockets Layer encrypted connection (SSL/TLS) | Select this checkbox if your SMTP server requires SSL/TLS. | +| Use implicit SSL authentication | Select this checkbox if your server uses implicit SSL mode, meaning it establishes an SSL connection before sending any meaningful data. Available only when **Use Secure Sockets Layer encrypted connection (SSL/TLS)** is selected. | +| Enforce certificate validation to ensure security | Select this checkbox to verify the security certificate on every email transmission. Selected by default. This option isn't available for User Activity auditing or Netwrix Auditor tools. | + +You can configure Activity Summary frequency, format, and delivery time for each monitoring plan +individually. See the [Fine-Tune Your Plan and Edit Settings](/docs/auditor/10.9/admin/monitoringplans/finetune.md) +topic for more information. diff --git a/docs/auditor/10.9/admin/settings/overview.md b/docs/auditor/10.9/admin/settings/overview.md index c4ec758e54..73fa719b05 100644 --- a/docs/auditor/10.9/admin/settings/overview.md +++ b/docs/auditor/10.9/admin/settings/overview.md @@ -14,7 +14,7 @@ information about the product version and your licenses. See the following secti - [Audit Database](/docs/auditor/10.9/admin/settings/auditdatabase.md) - [Long-Term Archive](/docs/auditor/10.9/admin/settings/longtermarchive.md) - [Investigations](/docs/auditor/10.9/admin/settings/investigations.md) -- [Notifications](/docs/auditor/10.9/admin/settings/notifications.md) +- [Notifications](/docs/auditor/10.9/admin/settings/notifications/notifications.md) - [Integrations](/docs/auditor/10.9/admin/settings/integrations.md) - [Licenses](/docs/auditor/10.9/admin/settings/licenses.md) - [About Netwrix Auditor](/docs/auditor/10.9/admin/settings/about.md)