diff --git a/docs/threatprevention/7.4/admin/overview_1.md b/docs/threatprevention/7.4/admin/Tags.md similarity index 100% rename from docs/threatprevention/7.4/admin/overview_1.md rename to docs/threatprevention/7.4/admin/Tags.md diff --git a/docs/threatprevention/7.4/admin/agents/agentmanagement/clearqueue.md b/docs/threatprevention/7.4/admin/agents/agentmanagement/clearqueue.md index 13b4f9ace9..7809d1fcf7 100644 --- a/docs/threatprevention/7.4/admin/agents/agentmanagement/clearqueue.md +++ b/docs/threatprevention/7.4/admin/agents/agentmanagement/clearqueue.md @@ -12,8 +12,11 @@ SQLite Agent Queue option dumps the queue and all pending events are lost. Follow the steps to clear the SQLite Agent queue for an Agent: -**CAUTION:** These events are permanently deleted and are not processed by the Enterprise Manager on +:::warning +These events are permanently deleted and are not processed by the Enterprise Manager on reconnection. This option is for diagnostic and troubleshooting purposes only. +::: + **Step 1 –** Click Agents in the left pane to launch the Agents interface. @@ -26,10 +29,13 @@ to connect to the target machine and query information about shares. A local Adm on the target machine should have access to the system shares. Click **OK** after entering the credentials. -**NOTE:** The wizard does not block access to the Administration Console and can be minimized while +:::note +The wizard does not block access to the Administration Console and can be minimized while actions are in progress. If this wizard is hidden by clicking outside of the dialog box, a flashing blue link displays on the upper right corner of the interface with the action name displayed. Click this link to bring back the focus to the wizard. +::: + **Step 4 –** On the Access Verification window, the given credentials either succeed or fail during a prerequisites or verification check. @@ -38,8 +44,11 @@ a prerequisites or verification check. of prior to the next attempt. - Success – Click **Next** to begin clearing the SQLite Agent Queue -**NOTE:** Closing the Administration Console while this action is in process causes problems with +:::note +Closing the Administration Console while this action is in process causes problems with data collection. +::: + **Step 5 –** The Clear Agent Queue window displays the task in progress and then its status as either: diff --git a/docs/threatprevention/7.4/admin/agents/agentmanagement/harden.md b/docs/threatprevention/7.4/admin/agents/agentmanagement/harden.md index 9d5de3718e..374fd010b5 100644 --- a/docs/threatprevention/7.4/admin/agents/agentmanagement/harden.md +++ b/docs/threatprevention/7.4/admin/agents/agentmanagement/harden.md @@ -22,10 +22,13 @@ to connect to the target machine and query information about shares. A local Adm on the target machine should have access to the system shares. Click **OK** after entering the credentials. -**NOTE:** The wizard does not block access to the Administration Console and can be minimized while +:::note +The wizard does not block access to the Administration Console and can be minimized while actions are in progress. If this wizard is hidden by clicking outside of the dialog box, a flashing blue link displays on the upper right corner of the interface with the action name displayed. Click this link to bring back the focus to the wizard. +::: + **Step 4 –** On the Access Verification window, the given credentials either succeed or fail during a prerequisites or verification check. @@ -34,8 +37,11 @@ a prerequisites or verification check. of prior to the next attempt. - Success – Click **Next** to begin hardening the Agent. -**NOTE:** Closing the Administration Console while this action is in process causes problems with +:::note +Closing the Administration Console while this action is in process causes problems with data collection. +::: + **Step 5 –** The Harden Agent window displays the task in progress and then its status as either: diff --git a/docs/threatprevention/7.4/admin/agents/agentmanagement/removeserver.md b/docs/threatprevention/7.4/admin/agents/agentmanagement/removeserver.md index 5b8b6aafb5..31f870f266 100644 --- a/docs/threatprevention/7.4/admin/agents/agentmanagement/removeserver.md +++ b/docs/threatprevention/7.4/admin/agents/agentmanagement/removeserver.md @@ -10,8 +10,11 @@ The Agents Interface displays a list of servers where the Agent has been deploye remove a server from this list for any reason, such as when the Agent is no longer required on the server. -**NOTE:** If the server has a deployed Agent, it will be added back to the list the next time the +:::note +If the server has a deployed Agent, it will be added back to the list the next time the Agent sends information to the Enterprise Manager. +::: + Follow the steps to remove a server from the list on the Agents Interface. diff --git a/docs/threatprevention/7.4/admin/agents/agentmanagement/soften.md b/docs/threatprevention/7.4/admin/agents/agentmanagement/soften.md index cfee34fb8d..c5a2b3ffcb 100644 --- a/docs/threatprevention/7.4/admin/agents/agentmanagement/soften.md +++ b/docs/threatprevention/7.4/admin/agents/agentmanagement/soften.md @@ -22,10 +22,13 @@ to connect to the target machine and query information about shares. A local Adm on the target machine should have access to the system shares. Click **OK** after entering the credentials. -**NOTE:** The wizard does not block access to the Administration Console and can be minimized while +:::note +The wizard does not block access to the Administration Console and can be minimized while actions are in progress. If this wizard is hidden by clicking outside of the dialog box, a flashing blue link displays on the upper right corner of the interface with the action name displayed. Click this link to bring back the focus to the wizard. +::: + **Step 4 –** On the Access Verification window, the given credentials either succeed or fail during a prerequisites or verification check. @@ -34,8 +37,11 @@ a prerequisites or verification check. of prior to the next attempt. - Success – Click **Next** to begin softening the Agent. -**NOTE:** Closing the Administration Console while this action is in process causes problems with +:::note +Closing the Administration Console while this action is in process causes problems with data collection. +::: + **Step 5 –** The Soften Agent window displays the task in progress and then its status as either: diff --git a/docs/threatprevention/7.4/admin/agents/agentmanagement/start.md b/docs/threatprevention/7.4/admin/agents/agentmanagement/start.md index 5ba9b441b3..f86015ac16 100644 --- a/docs/threatprevention/7.4/admin/agents/agentmanagement/start.md +++ b/docs/threatprevention/7.4/admin/agents/agentmanagement/start.md @@ -22,10 +22,13 @@ to connect to the target machine and query information about shares. A local Adm on the target machine should have access to the system shares. Click **OK** after entering the credentials. -**NOTE:** The wizard does not block access to the Administration Console and can be minimized while +:::note +The wizard does not block access to the Administration Console and can be minimized while actions are in progress. If this wizard is hidden by clicking outside of the dialog box, a flashing blue link displays on the upper right corner of the interface with the action name displayed. Click this link to bring back the focus to the wizard. +::: + **Step 4 –** On the Start Agent window, the Agent will be started. One of two status messages display: diff --git a/docs/threatprevention/7.4/admin/agents/agentmanagement/startpendingmodules.md b/docs/threatprevention/7.4/admin/agents/agentmanagement/startpendingmodules.md index 343e1f0f48..d243a4c60b 100644 --- a/docs/threatprevention/7.4/admin/agents/agentmanagement/startpendingmodules.md +++ b/docs/threatprevention/7.4/admin/agents/agentmanagement/startpendingmodules.md @@ -13,11 +13,14 @@ Prevention administrator must start the Active Directory module. See the [Agent Safe Mode](/docs/threatprevention/7.4/admin/agents/safemode.md) topic for additional information. -**_RECOMMENDED:_** If multiple DCs are in the Start Pending Modules state, this means one of the +:::info +If multiple DCs are in the Start Pending Modules state, this means one of the monitored system DLLs was changed from when the Agent was last run. This could impact the operation of the Agent. It is recommended to enable the pending modules on one DC initially and verify that Threat Prevention is collecting events as expected from this specific DC and that the DC appears to be stable before starting the pending modules on additional DCs. +::: + Follow the steps to start pending modules on a server. diff --git a/docs/threatprevention/7.4/admin/agents/agentmanagement/stop.md b/docs/threatprevention/7.4/admin/agents/agentmanagement/stop.md index 75d3ad2fbf..ed1d3a2d4d 100644 --- a/docs/threatprevention/7.4/admin/agents/agentmanagement/stop.md +++ b/docs/threatprevention/7.4/admin/agents/agentmanagement/stop.md @@ -21,10 +21,13 @@ to connect to the target machine and query information about shares. A local Adm on the target machine should have access to the system shares. Click **OK** after entering the credentials. -**NOTE:** The wizard does not block access to the Administration Console and can be minimized while +:::note +The wizard does not block access to the Administration Console and can be minimized while actions are in progress. If this wizard is hidden by clicking outside of the dialog box, a flashing blue link displays on the upper right corner of the interface with the action name displayed. Click this link to bring back the focus to the wizard. +::: + **Step 4 –** On the Stop Agent window, the Agent will be stopped. One of two status messages display: diff --git a/docs/threatprevention/7.4/admin/agents/agentswindows/agentinstallerupdate.md b/docs/threatprevention/7.4/admin/agents/agentswindows/agentinstallerupdate.md index 1dda255113..d5ca50681b 100644 --- a/docs/threatprevention/7.4/admin/agents/agentswindows/agentinstallerupdate.md +++ b/docs/threatprevention/7.4/admin/agents/agentswindows/agentinstallerupdate.md @@ -39,6 +39,9 @@ currently in use to the installer downloaded. - If the downloaded version is newer, the message displays both version numbers and provides an option to apply the update. Click **Apply Update**. -**NOTE:** When the Agent installer is replaced with a newer version, all Agents’ versions in the +:::note +When the Agent installer is replaced with a newer version, all Agents’ versions in the Agents interface are highlighted to indicate they are not the current version. Agents should then be updated to the new version, using the Upgrade Agent option on the right-click menu. + +::: diff --git a/docs/threatprevention/7.4/admin/agents/agentswindows/enrollmentsecretconfiguration.md b/docs/threatprevention/7.4/admin/agents/agentswindows/enrollmentsecretconfiguration.md index 26c51b4fb6..0c4418a7c7 100644 --- a/docs/threatprevention/7.4/admin/agents/agentswindows/enrollmentsecretconfiguration.md +++ b/docs/threatprevention/7.4/admin/agents/agentswindows/enrollmentsecretconfiguration.md @@ -46,4 +46,7 @@ manually deploy the Agent. It has the following fields: - Click **Copy** to copy the enrollment secret and enter it in the Certificates window of the Agent Setup wizard during manual Agent installation. -**NOTE:** Restarting the Enterprise Manager cancels the current enrollment secret. +:::note +Restarting the Enterprise Manager cancels the current enrollment secret. + +::: diff --git a/docs/threatprevention/7.4/admin/agents/agentswindows/loglevelconfiguration.md b/docs/threatprevention/7.4/admin/agents/agentswindows/loglevelconfiguration.md index 45cbe32669..38ff519625 100644 --- a/docs/threatprevention/7.4/admin/agents/agentswindows/loglevelconfiguration.md +++ b/docs/threatprevention/7.4/admin/agents/agentswindows/loglevelconfiguration.md @@ -9,10 +9,13 @@ sidebar_position: 40 The Log Level Configuration window displays the current log levels for the Agents, Enterprise Manager, and Administration Console. It also enables you to set new log levels. -**NOTE:** Since Threat Prevention supports multiple instances of the Administration Console, each +:::note +Since Threat Prevention supports multiple instances of the Administration Console, each instance has its own settings for log levels. Changing the settings only affect the respective console instance. The Enterprise Manager and Agent log settings are global - the most recent changes made from any console instance apply. +::: + Follow the steps to set log levels. @@ -83,13 +86,13 @@ Console log files are stored on the machine where the respective console is inst Log files are stored in the following locations: -Enterprise Manager Log Files +**Enterprise Manager Log Files** ![Enterprise Manager Log File Location](/img/product_docs/threatprevention/7.4/admin/agents/window/emlogs.webp) The default location is: -…\Netwrix\Netwrix Threat Prevention\SIEnterpriseManager\logs\ +**…\Netwrix\Netwrix Threat Prevention\SIEnterpriseManager\logs\** Administration Console Log Files @@ -97,7 +100,10 @@ Administration Console Log Files The default location is: -…\Netwrix\Netwrix Threat Prevention\SIWinConsole\logs\ +**…\Netwrix\Netwrix Threat Prevention\SIWinConsole\logs\** -**NOTE:** Log files for a remote instance of the Administration Console are available at the same +:::note +Log files for a remote instance of the Administration Console are available at the same location on the respective machine. + +::: diff --git a/docs/threatprevention/7.4/admin/agents/deploy/overview.md b/docs/threatprevention/7.4/admin/agents/deploy/overview.md index aa9912101f..e17ddfd368 100644 --- a/docs/threatprevention/7.4/admin/agents/deploy/overview.md +++ b/docs/threatprevention/7.4/admin/agents/deploy/overview.md @@ -11,7 +11,10 @@ The Threat Prevention Agent can be deployed through any of the following methods - Deploy the Agent to server(s) through the Administration Console – You can deploy the Agent to one or multiple servers through the Administration Console - **_RECOMMENDED:_** This is the recommended method for deploying the Agent. + :::info + This is the recommended method for deploying the Agent. + ::: + - Manually through the Windows Agent Setup Wizard – Run the Agent executable to launch this wizard @@ -28,10 +31,13 @@ compatibility with other security products. See the [Agent Server Requirements](/docs/threatprevention/7.4/requirements/agent/agent.md) topic for additional information. -**NOTE:** The wizard does not block access to the Administration Console and can be minimized while +:::note +The wizard does not block access to the Administration Console and can be minimized while actions are in progress. If this wizard is hidden by clicking outside of the dialog box, a flashing blue link displays on the upper right corner of the interface with the action name displayed. Click this link to bring back the focus to the wizard. +::: + The Deploy Agents wizard consists of four windows: Select Computers, Set Options, Prerequisites Check, and Installing. @@ -39,8 +45,11 @@ Check, and Installing. Follow the steps to deploy the Agent from the Administration Console to a new or existing machine using the Deploy Agents wizard. -**CAUTION:** Closing the Administration Console while this action is in process causes problems with +:::warning +Closing the Administration Console while this action is in process causes problems with data collection. +::: + **Step 1 –** Click Agents in the left pane to launch the Agents interface. @@ -90,11 +99,14 @@ topic for additional information. The Agent will be listed in the table on the Agents interface. -**NOTE:** If the server where the Agent is deployed has multiple network adapters (multi-homed), +:::note +If the server where the Agent is deployed has multiple network adapters (multi-homed), then it is necessary to bind the Agent to an adapter that can communicate with the Enterprise Manager. See the [Bind To](/docs/threatprevention/7.4/troubleshooting/agentcommunication.md#bind-to) topic for additional information. +::: + ## Update Agent Settings diff --git a/docs/threatprevention/7.4/admin/agents/deploy/setoptions.md b/docs/threatprevention/7.4/admin/agents/deploy/setoptions.md index 110f35c261..6160b41e18 100644 --- a/docs/threatprevention/7.4/admin/agents/deploy/setoptions.md +++ b/docs/threatprevention/7.4/admin/agents/deploy/setoptions.md @@ -38,9 +38,12 @@ The Set Options window provides the following options: Enterprise Manager to the Agent(s) as long as the Agent service is enabled. - Start Agent Service – Starts the Threat Prevention Agent service on host after installation - **NOTE:** If the Agent Service is not started at the time of deployment, the Agent requires + :::note + If the Agent Service is not started at the time of deployment, the Agent requires a manual start or will be started automatically after a server reboot. Until the Agent is started, no activity is monitored or blocked. + ::: + - Create Windows Firewall Rules – Creates firewall rules on the selected computers for Agent communication @@ -93,10 +96,13 @@ the window appears as follows: This window displays the default selections in the Modules to Set and Additional Options areas; they do not represent the actual current state of the Agent. -**NOTE:** To view the current state and configured options for an Agent, hover over the Version +:::note +To view the current state and configured options for an Agent, hover over the Version String column on the [Agents Interface](/docs/threatprevention/7.4/admin/agents/overview.md) data grid for the tool tip. The AD Agent column indicates the Agent’s mode. +::: + This Set Options window is the same as discussed above, with the exception of the following: @@ -110,6 +116,9 @@ This Set Options window is the same as discussed above, with the exception of th This setting has no impact on the Use These Credentials and Enterprise Manager areas. -**CAUTION:** Make sure you select the desired settings for the Agent on this window, such as the +:::warning +Make sure you select the desired settings for the Agent on this window, such as the Enable DNS Host Name Resolution and Safe Mode options, even when they are currently enabled for the Agent. Leaving them unchecked will disable those settings when the wizard completes. + +::: diff --git a/docs/threatprevention/7.4/admin/agents/overview.md b/docs/threatprevention/7.4/admin/agents/overview.md index a5de1ddec6..d7329cace6 100644 --- a/docs/threatprevention/7.4/admin/agents/overview.md +++ b/docs/threatprevention/7.4/admin/agents/overview.md @@ -16,7 +16,10 @@ The Threat Prevention Agent can be deployed through any of the following methods - Deploy the Agent to server(s) through the Administration Console – You can deploy the Agent to one or multiple servers through the Administration Console - **_RECOMMENDED:_** This is the recommended method for deploying the Agent. + :::info + This is the recommended method for deploying the Agent. + ::: + - Manually through the Windows Agent Setup Wizard – Run the Agent executable to launch this wizard @@ -51,20 +54,26 @@ information for an Agent: - AD Event Latency – Time difference between when the event was detected by the Agent and when the Enterprise Manager received it - **NOTE:** When the **Send Latency Alerts** option is enabled in the + :::note + When the **Send Latency Alerts** option is enabled in the [Event Filtering Configuration Window](/docs/threatprevention/7.4/admin/configuration/eventfilteringconfiguration.md), a warning symbol appears to indicate excessive latency. This warning symbol also appears when the Agent fails to load the instrumentation DLL into the LSASS process or when it fails to load the instrumentation DLL to MS Exchange. + ::: + - FSMO Roles – The FSMO (Flexible Single Master Operation) role(s) currently assigned to the domain controller where the Agent is deployed. Role names are displayed as abbreviations. For example, 'SM' is displayed for the Schema Master role. Hover over data in this column to view the full names. - **NOTE:** You can use the FSMO roles information in combination with a policy created for the + :::note + You can use the FSMO roles information in combination with a policy created for the [FSMO Role Monitoring Event Type](/docs/threatprevention/7.4/admin/policies/configuration/eventtype/fsmorolemonitoring.md) to view events about which machine acquired a FSMO role and which machine relinquished it. + ::: + - Operating System – Operating system for the machine where the Agent is deployed with version information, including service pack details. For example, Windows Server 2022 Standard.. For @@ -122,16 +131,17 @@ topic for additional information. The following icons above the data grid enable you to perform various actions on the Agents interface -| Icon | Label | Action | -| ---------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| ![Agents Interface - Export Agent List icon](/img/product_docs/threatprevention/7.4/admin/agents/exporticon.webp) | Export Agent List… | Save the information to an XML file for export | -| ![Agents Interface - Refresh Agent List icon](/img/product_docs/threatprevention/7.4/admin/agents/refreshicon.webp) | Refresh Agent List… | Refresh the Agent information | -| ![Agents Interface - Update Logging Levels icon](/img/product_docs/threatprevention/7.4/admin/agents/updateloggingicon.webp) | Update Logging Levels… | Configure the log levels for the Agent(s). It opens the [Log Level Configuration Window](/docs/threatprevention/7.4/admin/agents/agentswindows/loglevelconfiguration.md). | -| ![Agents Interface - Get Agent Log icon](/img/product_docs/threatprevention/7.4/admin/agents/getagentlogicon.webp) | Get Agent Log… | Access Agent log files. See the [Access Agent Log Files](/docs/threatprevention/7.4/admin/agents/agentswindows/loglevelconfiguration.md#access-agent-log-files) topic for additional information. | -| ![Agents Interface - Update Agent Installer icon](/img/product_docs/threatprevention/7.4/admin/agents/updateinstallericon.webp) | Update Agent Installer | Check with Netwrix for a newer version of the Agent Installer according to the version in use. It opens the [Agent Installer Update Window](/docs/threatprevention/7.4/admin/agents/agentswindows/agentinstallerupdate.md). | -| ![Agents Interface - Configure Auto Deploy icon](/img/product_docs/threatprevention/7.4/admin/agents/autodeployicon.webp) | Configure Auto Deploy | If enabled, the Agent is automatically deployed to all domain controllers without an Agent. This feature requires at least one Agent to be present in the domain in order to detect additional domain controllers. It opens the [Configure Auto Deploy Window](/docs/threatprevention/7.4/admin/agents/agentswindows/configureautodeploy.md). | -| ![Agents Interface - Agent Enrollment Secret icon](/img/product_docs/threatprevention/7.4/admin/agents/enrollmentsecreticon.webp) | Agent Enrollment Secret | Generate the enrollment secret used to deploy the Agent. Opens the [Enrollment Secret Configuration Window](/docs/threatprevention/7.4/admin/agents/agentswindows/enrollmentsecretconfiguration.md). | -| ![Agents Interface - Deploy Agent icon](/img/product_docs/threatprevention/7.4/admin/agents/deployagent.webp) | Deploy Agent | Deploy the Agent to selected servers. It opens the Deploy Agents wizard. See the [Deploy Agents](/docs/threatprevention/7.4/admin/agents/deploy/overview.md) topic for additional information. | +| Icon | Label | Action | +| --------------- | ----------------------- | -------------- | +| ![Export Agent List icon](/img/product_docs/threatprevention/7.4/admin/agents/exporticon.webp) | Export Agent List… | Save the information to an XML file for export | +| ![Refresh Agent List icon](/img/product_docs/threatprevention/7.4/admin/agents/refreshicon.webp) | Refresh Agent List… | Refresh the Agent information | +| ![Update Logging Levels icon](/img/product_docs/threatprevention/7.4/admin/agents/updateloggingicon.webp) | Update Logging Levels… | Configure the log levels for the Agent(s). It opens the [Log Level Configuration Window](/docs/threatprevention/7.4/admin/agents/agentswindows/loglevelconfiguration.md). | +| ![Get Agent Log icon](/img/product_docs/threatprevention/7.4/admin/agents/getagentlogicon.webp) | Get Agent Log… | Access Agent log files. See the [Access Agent Log Files](/docs/threatprevention/7.4/admin/agents/agentswindows/loglevelconfiguration.md#access-agent-log-files) topic for additional information. | +| ![Update Agent Installer icon](/img/product_docs/threatprevention/7.4/admin/agents/updateinstallericon.webp) | Update Agent Installer | Check with Netwrix for a newer version of the Agent Installer according to the version in use. It opens the [Agent Installer Update Window](/docs/threatprevention/7.4/admin/agents/agentswindows/agentinstallerupdate.md). | +| ![Configure Auto Deploy icon](/img/product_docs/threatprevention/7.4/admin/agents/autodeployicon.webp) | Configure Auto Deploy | If enabled, the Agent is automatically deployed to all domain controllers without an Agent. This feature requires at least one Agent to be present in the domain in order to detect additional domain controllers. It opens the [Configure Auto Deploy Window](/docs/threatprevention/7.4/admin/agents/agentswindows/configureautodeploy.md). | +| ![Agent Enrollment Secret icon](/img/product_docs/threatprevention/7.4/admin/agents/enrollmentsecreticon.webp) | Agent Enrollment Secret | Generate the enrollment secret used to deploy the Agent. Opens the [Enrollment Secret Configuration Window](/docs/threatprevention/7.4/admin/agents/agentswindows/enrollmentsecretconfiguration.md). | +| ![Deploy Agent icon](/img/product_docs/threatprevention/7.4/admin/agents/deployagent.webp) | Deploy Agent | Deploy the Agent to selected servers. It opens the Deploy Agents wizard. See the [Deploy Agents](/docs/threatprevention/7.4/admin/agents/deploy/overview.md) topic for additional information. | + ## Right-Click Menu @@ -188,10 +198,13 @@ Below are some considerations: Prevention administrator should check if the Agent service is set to manual start. The most likely solution is to upgrade to the latest version of the Agent. - **_RECOMMENDED:_** Activate an email notification for the _LSASS process terminated_ alert. See + :::info + Activate an email notification for the _LSASS process terminated_ alert. See the [Enable the 'LSASS Process Terminated' Email Alert](/docs/threatprevention/7.4/troubleshooting/lsass.md#enable-the-lsass-process-terminated-email-alert) topic for additional information. + ::: + - In addition to the LSASS process termination check, the Agent can be configured for a Safe Mode. In Safe Mode, the Agent records the version of the LSASS DLLs that it hooks into during @@ -204,8 +217,11 @@ Below are some considerations: [Start Pending Modules](/docs/threatprevention/7.4/admin/agents/agentmanagement/startpendingmodules.md) topic for additional information. - **_RECOMMENDED:_** Activate an email notification for this alert. See the + :::info + Activate an email notification for this alert. See the [Enable Agent Started in AD Monitor Pending Mode Email Alert](/docs/threatprevention/7.4/admin/agents/safemode.md#enable-agent-started-in-ad-monitor-pending-mode-email-alert) topic and the [Agent Safe Mode](/docs/threatprevention/7.4/admin/agents/safemode.md) topic for additional information. + + ::: diff --git a/docs/threatprevention/7.4/admin/agents/safemode.md b/docs/threatprevention/7.4/admin/agents/safemode.md index 77ea9b6e84..77d6c36851 100644 --- a/docs/threatprevention/7.4/admin/agents/safemode.md +++ b/docs/threatprevention/7.4/admin/agents/safemode.md @@ -18,10 +18,13 @@ LSASS process. Below are some considerations: Prevention administrator should check if the Agent service is set to manual start. The most likely solution is to upgrade to the latest version of the Agent. - **_RECOMMENDED:_** Activate an email notification for the _LSASS process terminated_ alert. See + :::info + Activate an email notification for the _LSASS process terminated_ alert. See the [Enable the 'LSASS Process Terminated' Email Alert](/docs/threatprevention/7.4/troubleshooting/lsass.md#enable-the-lsass-process-terminated-email-alert) topic for additional information. + ::: + - In addition to the LSASS process termination check, the Agent can be configured for a Safe Mode. In Safe Mode, the Agent records the version of the LSASS DLLs that it hooks into during @@ -34,16 +37,25 @@ LSASS process. Below are some considerations: [Start Pending Modules](/docs/threatprevention/7.4/admin/agents/agentmanagement/startpendingmodules.md) topic for additional information. - **_RECOMMENDED:_** Activate an email notification for this alert. See the + :::info + Activate an email notification for this alert. See the [Enable Agent Started in AD Monitor Pending Mode Email Alert](#enable-agent-started-in-ad-monitor-pending-mode-email-alert) topic for additional information. + ::: + -_Remember,_ in Safe Mode, Threat Prevention does not terminate the LSASS process; it only prevents +:::tip +Remember, in Safe Mode, Threat Prevention does not terminate the LSASS process; it only prevents the Active Directory monitoring/blocking module from loading on the Agent machine every time key LSASS DLLs are changed. +::: + -**NOTE:** Most Microsoft Security Bulletins that alter LSASS will not interfere with Agent +:::note +Most Microsoft Security Bulletins that alter LSASS will not interfere with Agent instrumentation. +::: + Active Directory monitoring/blocking will not resume until the pending modules are started. To determine if the LSASS changes will conflict with the Agent instrumentation, start the pending @@ -63,9 +75,12 @@ are overwritten with the current versions. Follow the steps to enable email notifications for the Agent Started in AD Monitor pending mode Operations alert. -**NOTE:** These steps require the Threat Prevention administrator role. They also assume that the +:::note +These steps require the Threat Prevention administrator role. They also assume that the [System Alerting Window](/docs/threatprevention/7.4/admin/configuration/systemalerting/overview.md) has been configured and email alerts have been enabled. +::: + **Step 1 –** Clck **Configuration** > **Alerts** on the menu. The Netwrix Threat Prevention System Alerting window opens. diff --git a/docs/threatprevention/7.4/admin/alerts/alertscleanup.md b/docs/threatprevention/7.4/admin/alerts/alertscleanup.md index 0a28e5b62b..a1bed72c75 100644 --- a/docs/threatprevention/7.4/admin/alerts/alertscleanup.md +++ b/docs/threatprevention/7.4/admin/alerts/alertscleanup.md @@ -10,9 +10,12 @@ You can clear alert data displayed on the [Alerts Interface](/docs/threatprevention/7.4/admin/alerts/overview.md) as well as schedule cleanups for this data. -**_RECOMMENDED:_** Export alert data before using the Clear option. See the +:::info +Export alert data before using the Clear option. See the [Alerts Export Window](/docs/threatprevention/7.4/admin/alerts/alertsexport.md) topic for additional information. +::: + Follow the steps to clear the alerts data. diff --git a/docs/threatprevention/7.4/admin/alerts/overview.md b/docs/threatprevention/7.4/admin/alerts/overview.md index 6e6cc39e26..05e58d361b 100644 --- a/docs/threatprevention/7.4/admin/alerts/overview.md +++ b/docs/threatprevention/7.4/admin/alerts/overview.md @@ -96,10 +96,13 @@ Below are some considerations: Prevention administrator should check if the Agent service is set to manual start. The most likely solution is to upgrade to the latest version of the Agent. - **_RECOMMENDED:_** Activate an email notification for the _LSASS process terminated_ alert. See + :::info + Activate an email notification for the _LSASS process terminated_ alert. See the [Enable the 'LSASS Process Terminated' Email Alert](/docs/threatprevention/7.4/troubleshooting/lsass.md#enable-the-lsass-process-terminated-email-alert) topic for additional information. + ::: + - In addition to the LSASS process termination check, the Agent can be configured for a Safe Mode. In Safe Mode, the Agent records the version of the LSASS DLLs that it hooks into during @@ -112,8 +115,11 @@ Below are some considerations: [Start Pending Modules](/docs/threatprevention/7.4/admin/agents/agentmanagement/startpendingmodules.md) topic for additional information. - **_RECOMMENDED:_** Activate an email notification for this alert. See the + :::info + Activate an email notification for this alert. See the [Enable Agent Started in AD Monitor Pending Mode Email Alert](/docs/threatprevention/7.4/admin/agents/safemode.md#enable-agent-started-in-ad-monitor-pending-mode-email-alert) topic and the [Agent Safe Mode](/docs/threatprevention/7.4/admin/agents/safemode.md) topic for additional information. + + ::: diff --git a/docs/threatprevention/7.4/admin/alerts/policycomparison.md b/docs/threatprevention/7.4/admin/alerts/policycomparison.md index 6ecd03ba14..d30336b52a 100644 --- a/docs/threatprevention/7.4/admin/alerts/policycomparison.md +++ b/docs/threatprevention/7.4/admin/alerts/policycomparison.md @@ -29,8 +29,11 @@ File Comparison Tool window opens. In the Path to Comparison Tool box, provide t comparison tool location in quotations. Next, add **%1 %2** after the quoted location path. for example, _cmd.exe /K fc.exe %1 %2_. Click **OK** to close the window. -**NOTE:** By default, fc.exe is specified as the path but it is recommended to replace this with a +:::note +By default, fc.exe is specified as the path but it is recommended to replace this with a path to a Windows based comparison tool such as Beyond Compare for best results. +::: + **Step 5 –** On the Policy Comparison window, click **Run Difference Tool** to run the specified compare command using the third party comparison tool. diff --git a/docs/threatprevention/7.4/admin/analytics/baduseridsourcehost.md b/docs/threatprevention/7.4/admin/analytics/baduseridsourcehost.md index 2e28c4fd9f..501c8afecd 100644 --- a/docs/threatprevention/7.4/admin/analytics/baduseridsourcehost.md +++ b/docs/threatprevention/7.4/admin/analytics/baduseridsourcehost.md @@ -15,7 +15,10 @@ expires. After the time expires, any additional attempt will generate a new inci for a report on the number of times a particular host used bad user accounts to try to login during the time frame. -**_RECOMMENDED:_** Configure the day limit to 30 days. +:::info +Configure the day limit to 30 days. +::: + | Bad User ID (by source host) | | | ---------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | @@ -24,7 +27,7 @@ the time frame. | Trigger | Any number of failed authentication attempts using non-existing accounts made from a specific host | | Recommended Settings | Bad User ID (by source host) groups attacks by where failed authentication attempts by non-existing accounts are coming from to trigger analytic hits. The user-configurable parameter is based on time, where time is used to visualize how often an attempt is made to authenticate using a non-existing account from an individual system. Netwrix recommends setting the default value to 30 days. If a failed authentication attempt using a non-existing account occurs from the same host after the 30 day time period, a new analytic hit will be produced rather than incrementing the previous hit count. | -Analytic Workflow +**Analytic Workflow** 1. Configure the analytic policy 2. Enable the analytic policy @@ -50,7 +53,7 @@ The Configure Analytics window has two tabs: - Policy – Where filters can be added, additional actions configured, a custom schedule set, and the policy enabled -Settings Tab +**Settings Tab** ![Bad User ID (by Source Host) Analytic Type - Settings tab](/img/product_docs/threatprevention/7.4/admin/analytics/baduseridsettings.webp) @@ -61,7 +64,7 @@ number of attempts through the limit of days set here, e.g. 30 days. After this elapsed from the first attempt, a new incident will be triggered for any additional attempt with a new count. -Policy Tab +**Policy Tab** ![Bad User ID (by Source Host) Analytic Type - Policy tab](/img/product_docs/threatprevention/7.4/admin/analytics/policytab.webp) @@ -81,9 +84,12 @@ The Policy tab for configuring analytics consists of three sub-tabs: - _Optional:_ Scope the protocol to be monitored on the Authentication Protocol filter. If enabling the analytic on a domain controller, also scope the login type. - **NOTE:** The Exclude failed authentications with ‘N-2’ passwords option requires a GPO + :::note + The Exclude failed authentications with ‘N-2’ passwords option requires a GPO within the organization be configured to ‘Enforce password history’ with a setting of a minimum of ‘3 passwords remembered’ or it will not have an effect. + ::: + - _Optional:_ Scope the domains to be included in or excluded from monitoring on the Domains/Servers filter. @@ -91,9 +97,12 @@ The Policy tab for configuring analytics consists of three sub-tabs: Addresses (from) filter, the IP Addresses (to) filter, the Hosts (from) filter, or the Hosts (to) filter. - **NOTE:** Some authentication events may return only a host name (NetBIOS or FQDN), others + :::note + Some authentication events may return only a host name (NetBIOS or FQDN), others may return only an IP address. It is recommended to take this into account when entering filter values. + ::: + - Actions tab – Configured the same way a regular policy’s [Actions Tab](/docs/threatprevention/7.4/admin/policies/configuration/actions/overview.md) diff --git a/docs/threatprevention/7.4/admin/analytics/baduseriduser.md b/docs/threatprevention/7.4/admin/analytics/baduseriduser.md index 7e158eb684..46c5d6fbc0 100644 --- a/docs/threatprevention/7.4/admin/analytics/baduseriduser.md +++ b/docs/threatprevention/7.4/admin/analytics/baduseriduser.md @@ -15,16 +15,19 @@ expires. After the time expires, any additional attempt will generate a new inci for a report on the number of times a particular bad user account tried to login during the time frame. -**_RECOMMENDED:_** Configure the day limit to 30 days. +:::info +Configure the day limit to 30 days. +::: -| Bad User ID (by user) | | -| --------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| Definition | Pre-authentication failures using one or more non-existing user IDs | + +| Bad User ID (by user) | | +| --------------------- | ------------- | +| Definition | Pre-authentication failures using one or more non-existing user IDs | | Example | Malware or a bad-actor is attempting to obtain access by guessing a user ID and password but has provided a user ID that does not exist. Most operating systems and devices have default administrative accounts such as “administrator” or “admin”. Because the account name is known, if left unchanged, the account becomes vulnerable to attack. To prevent this, most organizations change the name of these accounts. In the case where the account has been renamed, a perpetrator attempting to hack a well-known account will actually be attempting to authenticate against an account that does not exist and will be detected by this analytic. This analytic looks for attacks, regardless of source, against non-existing accounts. | -| Trigger | Any number of failed authentication attempts made by a non-existing account | -| Recommended Settings | Bad User ID (by user) groups attacks by account name where every new non-existing account will generate an analytic hit. The user-configurable parameter is based on time, where time is used to visualize how often an attempt is made to authenticate using the same non-existing account name. Netwrix recommends setting the default value to 30 days. If an attempt to use that same non-existing account name occurs after the 30 day time period, a new analytic hit will be produced rather than incrementing the previous hit count. | +| Trigger | Any number of failed authentication attempts made by a non-existing account | +| Recommended Settings | Bad User ID (by user) groups attacks by account name where every new non-existing account will generate an analytic hit. The user-configurable parameter is based on time, where time is used to visualize how often an attempt is made to authenticate using the same non-existing account name.
Netwrix recommends setting the default value to 30 days. If an attempt to use that same non-existing account name occurs after the 30 day time period, a new analytic hit will be produced rather than incrementing the previous hit count. | -Analytic Workflow +**Analytic Workflow** 1. Configure the analytic policy 2. Enable the analytic policy @@ -49,7 +52,7 @@ The Configure Analytics window has two tabs: - Policy – Where filters can be added, additional actions configured, a custom schedule set, and the policy enabled -Settings Tab +**Settings Tab** ![Bad User ID (by User) Analytic Type - Settings tab](/img/product_docs/threatprevention/7.4/admin/analytics/baduseridsettings.webp) @@ -59,7 +62,7 @@ additional attempt for the same bad user account will be added to the total numb through the limit of days set here, e.g. 30 days. After this number of days has elapsed from the first attempt, a new incident will be triggered for any additional attempt with a new count. -Policy Tab +**Policy Tab** ![Bad User ID (by User) Analytic Type - Policy tab](/img/product_docs/threatprevention/7.4/admin/analytics/policytab.webp) @@ -79,9 +82,12 @@ The **Policy** tab for configuring analytics consists of three sub-tabs: - *Optional:* Scope the protocol to be monitored on the Authentication Protocol filter. If enabling the analytic on a domain controller, also scope the login type. - **NOTE:** The Exclude failed authentications with ‘N-2’ passwords option requires a GPO + :::note + The Exclude failed authentications with ‘N-2’ passwords option requires a GPO within the organization be configured to ‘Enforce password history’ with a setting of a minimum of ‘3 passwords remembered’ or it will not have an effect. + ::: + - _Optional:_ Scope the domains to be included in or excluded from monitoring on the Domains/Servers filter. @@ -89,9 +95,12 @@ The **Policy** tab for configuring analytics consists of three sub-tabs: Addresses (from) filter, the IP Addresses (to) filter, the Hosts (from) filter, or the Hosts (to) filter. - **NOTE:** Some authentication events may return only a host name (NetBIOS or FQDN), others + :::note + Some authentication events may return only a host name (NetBIOS or FQDN), others may return only an IP address. It is recommended to take this into account when entering filter values. + ::: + - Actions tab – Configured the same way a regular policy’s [Actions Tab](/docs/threatprevention/7.4/admin/policies/configuration/actions/overview.md) diff --git a/docs/threatprevention/7.4/admin/analytics/breachedpassword.md b/docs/threatprevention/7.4/admin/analytics/breachedpassword.md index c78d7374da..f0d952e346 100644 --- a/docs/threatprevention/7.4/admin/analytics/breachedpassword.md +++ b/docs/threatprevention/7.4/admin/analytics/breachedpassword.md @@ -16,7 +16,7 @@ successful authentication in the specified time frame. | Trigger | X failed authentication attempts from the same account followed by a successful authentication in Y hours | | Recommended Settings | Netwrix recommends configuring this analytic to trigger a hit if Threat Prevention monitors at least 30 failed authentication attempts from the same account followed by a successful authentication in 4 hours. | -Analytic Workflow +**Analytic Workflow** 1. Configure the analytic policy 2. Enable the analytic policy @@ -41,7 +41,7 @@ The Configure Analytics window has two tabs: - Policy – Where filters can be added, additional actions configured, a custom schedule set, and the policy enabled -Settings Tab +**Settings Tab** ![Breached Password Analytic Type - Settings tab](/img/product_docs/threatprevention/7.4/admin/analytics/breachedpasswordsettings.webp) @@ -55,7 +55,7 @@ triggered, an incident record is saved to the database along with the events tha incident. Raw authentication event data that did not contribute to an incident are purged from memory once they are more than 24 hours old. -Policy Tab +**Policy Tab** ![Breached Password Analytic Type - Policy tab](/img/product_docs/threatprevention/7.4/admin/analytics/policytab.webp) @@ -74,9 +74,12 @@ The **Policy** tab for configuring analytics consists of three sub-tabs: - Scope the protocol to be monitored on the Authentication Protocol filter. If enabling the analytic on a domain controller, also scope the login type. - **NOTE:** The Exclude failed authentications with ‘N-2’ passwords option requires a GPO + :::note + The Exclude failed authentications with ‘N-2’ passwords option requires a GPO within the organization be configured to ‘Enforce password history’ with a setting of a minimum of ‘3 passwords remembered’ or it will not have an effect. + ::: + - _Optional:_ Scope the domains to be included in or excluded from monitoring on the Domains/Servers filter. @@ -86,9 +89,12 @@ The **Policy** tab for configuring analytics consists of three sub-tabs: Addresses (from) filter, the IP Addresses (to) filter, the Hosts (from) filter, or the Hosts (to) filter. - **NOTE:** Some authentication events may return only a host name (NetBIOS or FQDN), others + :::note + Some authentication events may return only a host name (NetBIOS or FQDN), others may return only an IP address. It is recommended to take this into account when entering filter values. + ::: + - Actions tab – Configured the same way a regular policy’s [Actions Tab](/docs/threatprevention/7.4/admin/policies/configuration/actions/overview.md) @@ -114,7 +120,10 @@ The top data grid includes the following information for each incident: - Attacked Account Name – Security principal of the account affected by the event - **NOTE:** The name will be red if the attacking account is the Administrator account. + :::note + The name will be red if the attacking account is the Administrator account. + ::: + - Attacked Account SID – Security Identifier of the account used in the event that was attacked - First Failed Attempt – Date timestamp of the first monitored event that triggered the incident. diff --git a/docs/threatprevention/7.4/admin/analytics/bruteforceattacks.md b/docs/threatprevention/7.4/admin/analytics/bruteforceattacks.md index 827bf3f815..d861c06654 100644 --- a/docs/threatprevention/7.4/admin/analytics/bruteforceattacks.md +++ b/docs/threatprevention/7.4/admin/analytics/bruteforceattacks.md @@ -9,8 +9,11 @@ sidebar_position: 40 The **Brute Force Attacks** analytic type identifies failed attempts from a single host to access a given host. -**_RECOMMENDED:_** Configure a subset of servers to be monitored in order to avoid the excessive +:::info +Configure a subset of servers to be monitored in order to avoid the excessive volume of event activity from monitoring all servers. +::: + | Brute Force Attacks | | | -------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | @@ -19,7 +22,7 @@ volume of event activity from monitoring all servers. | Trigger | X failed logins from a single host against a single host in Y minutes | | Recommended Settings | Configure this analytic to trigger a hit if Threat Prevention monitors at least 40 failed logins from a single host against a single host in 3 minutes. | -Analytic Workflow +**Analytic Workflow** 1. Configure the analytic policy 2. Enable the analytic policy @@ -44,7 +47,7 @@ The Configure Analytics window has two tabs: - Policy – Where filters can be added, additional actions configured, a custom schedule set, and the policy enabled -Settings Tab +**Settings Tab** ![Brute Force Attacks Analytic Type - Settings tab](/img/product_docs/threatprevention/7.4/admin/analytics/bruteforceattackssettings.webp) @@ -63,7 +66,7 @@ Click the **Configure Hosts** link to open the **Policy** > **Event Type** > **H If checked, the **Ignore failed logins for unresolved user names** option will exclude bad user IDs from contributing to Brute Force Attacks incidents. -Policy Tab +**Policy Tab** ![Brute Force Attacks Analytic Type - Policy tab](/img/product_docs/threatprevention/7.4/admin/analytics/policytab.webp) @@ -82,18 +85,24 @@ The **Policy** tab for configuring analytics consists of three sub-tabs: - Scope the servers to be included in or excluded from monitoring on the IP Addresses (from) filter, the IP Addresses (to) filter, the Hosts (from) filter, or the Hosts (to) filter. - **NOTE:** Some authentication events may return only a host name (NetBIOS or FQDN), others + :::note + Some authentication events may return only a host name (NetBIOS or FQDN), others may return only an IP address. It is recommended to take this into account when entering filter values. + ::: + - *Alternatively:* Scope the domains to be included in or excluded from monitoring on the Domains/Servers filter. - _Optional:_ Scope the protocol to be monitored on the Authentication Protocol filter. If enabling the analytic on a domain controller, also scope the login type. - **NOTE:** The Exclude failed authentications with ‘N-2’ passwords option requires a GPO + :::note + The Exclude failed authentications with ‘N-2’ passwords option requires a GPO within the organization be configured to ‘Enforce password history’ with a setting of a minimum of ‘3 passwords remembered’ or it will not have an effect. + ::: + - _Optional:_ Scope the accounts to include in or exclude from being monitored on the AD Perpetrator filter. diff --git a/docs/threatprevention/7.4/admin/analytics/concurrentlogins.md b/docs/threatprevention/7.4/admin/analytics/concurrentlogins.md index a6db451614..a3dbdb7dcb 100644 --- a/docs/threatprevention/7.4/admin/analytics/concurrentlogins.md +++ b/docs/threatprevention/7.4/admin/analytics/concurrentlogins.md @@ -9,8 +9,11 @@ sidebar_position: 50 The **Concurrent Logins** analytic type identifies same account logins from multiple locations within the specified time frame. -**_RECOMMENDED:_** Configure a subset of accounts and/or servers to be monitored in order to avoid +:::info +Configure a subset of accounts and/or servers to be monitored in order to avoid the excessive volume of event activity from monitoring all. +::: + | Concurrent Logins | | | -------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | @@ -19,7 +22,7 @@ the excessive volume of event activity from monitoring all. | Trigger | Successful and failed authentications using the same account from at least X hosts in Y minutes | | Recommended Settings | Netwrix recommends configuring this analytic to trigger a hit if Threat Prevention monitors either successful or failed authentications using the same account from at least 3 hosts in 1 hour. | -Analytic Workflow +**Analytic Workflow** 1. Configure the analytic policy 2. Enable the analytic policy @@ -44,7 +47,7 @@ The Configure Analytics window has two tabs: - Policy – Where filters can be added, additional actions configured, a custom schedule set, and the policy enabled -Settings Tab +**Settings Tab** ![Concurrent Logins Analytic Type - Settings tab](/img/product_docs/threatprevention/7.4/admin/analytics/concurrentloginssettings.webp) @@ -58,7 +61,7 @@ triggered, an incident record is saved to the database along with the events tha incident. Raw authentication event data that did not contribute to an incident are purged from memory once they are more than 24 hours old. -Policy Tab +**Policy Tab** ![Concurrent Logins Analytic Type - Policy tab](/img/product_docs/threatprevention/7.4/admin/analytics/policytab.webp) @@ -77,9 +80,12 @@ The **Policy** tab for configuring analytics consists of three sub-tabs: - _Optional:_ Scope the protocol to be monitored on the Authentication Protocol filter. If enabling the analytic on a domain controller, also scope the login type. - **NOTE:** The Exclude failed authentications with ‘N-2’ passwords option requires a GPO + :::note + The Exclude failed authentications with ‘N-2’ passwords option requires a GPO within the organization be configured to ‘Enforce password history’ with a setting of a minimum of ‘3 passwords remembered’ or it will not have an effect. + ::: + - _Optional:_ Scope the domains to be included in or excluded from monitoring on the Domains/Servers filter. @@ -89,9 +95,12 @@ The **Policy** tab for configuring analytics consists of three sub-tabs: Addresses (from) filter, the IP Addresses (to) filter, the Hosts (from) filter, or the Hosts (to) filter. - **NOTE:** Some authentication events may return only a host name (NetBIOS or FQDN), others + :::note + Some authentication events may return only a host name (NetBIOS or FQDN), others may return only an IP address. It is recommended to take this into account when entering filter values. + ::: + - Actions tab – Configured the same way a regular policy’s [Actions Tab](/docs/threatprevention/7.4/admin/policies/configuration/actions/overview.md) @@ -117,7 +126,10 @@ The top data grid includes the following information for each incident: - Attacking Account Name – Security principal of the account that triggered the incident - **NOTE:** The name will be red if the attacking account is the Administrator account. + :::note + The name will be red if the attacking account is the Administrator account. + ::: + - Attacking Account SID – Security Identifier of the account used in the event that triggered the incident diff --git a/docs/threatprevention/7.4/admin/analytics/filesystemattacksuser.md b/docs/threatprevention/7.4/admin/analytics/filesystemattacksuser.md index 4de6aea692..81daaec5e3 100644 --- a/docs/threatprevention/7.4/admin/analytics/filesystemattacksuser.md +++ b/docs/threatprevention/7.4/admin/analytics/filesystemattacksuser.md @@ -21,7 +21,7 @@ If desired, the analytic can be configured to lockdown the monitored file system | Trigger | X number of files changed by an account in Y minutes | | Recommended Settings | Netwrix recommends configuring this analytic to trigger a hit if Threat Prevention monitors 500 files affected in 3 minutes. | -Analytic Workflow +**Analytic Workflow** 1. Configure the analytic policy 2. Enable the analytic policy @@ -47,7 +47,7 @@ The Configure Analytics window has two tabs: - Policy – Where filters can be added, additional actions configured, a custom schedule set, and the policy enabled -Settings Tab +**Settings Tab** ![File System Attacks (by User) Analytic Type - Settings tab](/img/product_docs/threatprevention/7.4/admin/analytics/filesystemattackssettings.webp) @@ -73,7 +73,7 @@ Type: File System Lockdown** > **AD Perpetrator (for Lockdown)** filter. As inci perpetrators of the triggering events will be added to the AD Perpetrators (for Lockdown) filter list and blocked from initiating future events. -Policy Tab for Monitoring Only +**Policy Tab for Monitoring Only** ![File System Attacks (by User) Analytic Type - Policy tab for Monitoring Only](/img/product_docs/threatprevention/7.4/admin/analytics/policytabfsmonitoring.webp) @@ -93,14 +93,20 @@ The **Policy** tab for configuring analytics consists of the following sub-tabs: Multiple paths and/or collections can be included and excluded, along with the option to monitor sub-folders. - _Remember,_ if no path is provided, an error message displays when the analytic policy is + :::tip + Remember, if no path is provided, an error message displays when the analytic policy is enabled: The “File System Analytic” policy must have at least one path to monitor defined. + ::: + - _Optional:_ Scope the operations being monitored on the File System filter. The default is to monitor Write and Rename operations. - **_RECOMMENDED:_** Do not scope to include Read operations due to the quantity of files read + :::info + Do not scope to include Read operations due to the quantity of files read within an organization. + ::: + - _Optional:_ Scope the monitoring Agents to use for monitoring on the Additional Agents filter. - _Optional:_ Scope the accounts to include in or exclude from being monitored on the AD @@ -116,7 +122,7 @@ The **Policy** tab for configuring analytics consists of the following sub-tabs: [System Alerting Window](/docs/threatprevention/7.4/admin/configuration/systemalerting/overview.md) to configure Email and SIEM alerts. -Policy Tab for Monitoring & Lockdown +**Policy Tab for Monitoring & Lockdown** ![File System Attacks (by User) Analytic Type - Policy tab for Monitoring and Lockdown](/img/product_docs/threatprevention/7.4/admin/analytics/policytabfsmonitoringlockdown.webp) @@ -146,8 +152,11 @@ The **Policy** tab for configuring analytics consists of the following sub-tabs: - _Optional:_ Scope the accounts to block additional perpetrators. - _Optional:_ Remove accounts that are being blocked from the list. - **NOTE:** Perpetrators manually removed from the list may be automatically re-added if + :::note + Perpetrators manually removed from the list may be automatically re-added if they trigger another incident + ::: + - Actions tab – Configured the same way a regular policy’s [Actions Tab](/docs/threatprevention/7.4/admin/policies/configuration/actions/overview.md) @@ -173,7 +182,10 @@ The top data grid includes the following information for each incident: - Attacking Account Name – Security principal of the account that triggered the incident - **NOTE:** The name will be red if the attacking account is the Administrator account. + :::note + The name will be red if the attacking account is the Administrator account. + ::: + - Attacking Account SID – Security Identifier of the account used in the event - First Attempt – Date timestamp of the first monitored event Hover over the data in this column to diff --git a/docs/threatprevention/7.4/admin/analytics/forgedpac.md b/docs/threatprevention/7.4/admin/analytics/forgedpac.md index ee20bed999..df91145838 100644 --- a/docs/threatprevention/7.4/admin/analytics/forgedpac.md +++ b/docs/threatprevention/7.4/admin/analytics/forgedpac.md @@ -11,14 +11,14 @@ modified PAC. By manipulating the PAC, a field in the Kerberos ticket that conta authorization data (in Active Directory, this is group membership), an attacker is able to grant themselves elevated privileges. -| Forged PAC | | -| -------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| Definition | Kerberos tickets with modified Privilege Account Certificate (PAC) | -| Example | Kerberos tickets are used as a sort of “pass card” to obtain access to resources. Once a domain controller authenticates a user, a TGT (ticket granting ticket) is granted with a limited lifespan. This is then used to obtain TGS (ticket granting service) and the TGS is what identifies a user to a resource on the network. A known vulnerability exists where PAC part of a ticket can be modified to include groups the user is not a member of. If a user on the network were to attempt to use such a ticket, this analytic would detect the altered ticket and generate an alert. | -| Trigger | PAC of the ticket contains RIDs that are not TokenGroups attribute. | -| Recommended Settings | No additional configuration needed | +| Forged PAC | | +| -------------------- | ---------------- | +| Definition | Kerberos tickets with modified Privilege Account Certificate (PAC) | +| Example | Kerberos tickets are used as a sort of “pass card” to obtain access to resources. Once a domain controller authenticates a user, a TGT (ticket granting ticket) is granted with a limited lifespan. This is then used to obtain TGS (ticket granting service) and the TGS is what identifies a user to a resource on the network.
A known vulnerability exists where PAC part of a ticket can be modified to include groups the user is not a member of. If a user on the network were to attempt to use such a ticket, this analytic would detect the altered ticket and generate an alert. | +| Trigger | PAC of the ticket contains RIDs that are not TokenGroups attribute. | +| Recommended Settings | No additional configuration needed | -Analytic Workflow +**Analytic Workflow** 1. Configure the analytic policy 2. Enable the analytic policy @@ -43,7 +43,7 @@ The Configure Analytics window has two tabs: - Policy – Where filters can be added, additional actions configured, a custom schedule set, and the policy enabled -Settings Tab +**Settings Tab** ![Forged PAC Analytic Type - Settings tab](/img/product_docs/threatprevention/7.4/admin/analytics/forgedpacsettings.webp) @@ -61,7 +61,7 @@ for a mismatch to trigger the incident. monitored for modifications. - The **Remove** (**x**) button removes the selected item(s) from the incident criteria. -Policy Tab +**Policy Tab** ![Forged PAC Analytic Type - Policy tab](/img/product_docs/threatprevention/7.4/admin/analytics/policytab.webp) @@ -80,9 +80,12 @@ The **Policy** tab for configuring analytics consists of three sub-tabs: - Scope the servers to be included in or excluded from monitoring on the IP Addresses (from) filter, the IP Addresses (to) filter, the Hosts (from) filter, or the Hosts (to) filter. - **NOTE:** Some authentication events may return only a host name (NetBIOS or FQDN), others + :::note + Some authentication events may return only a host name (NetBIOS or FQDN), others may return only an IP address. It is recommended to take this into account when entering filter values. + ::: + - _Alternatively:_ Scope the domains to be included in or excluded from monitoring on the Domains/Servers filter. @@ -90,9 +93,12 @@ The **Policy** tab for configuring analytics consists of three sub-tabs: enabling the analytic on a domain controller, also scope the login type. The Authentication Protocol filter is hard coded to ensure the Kerberos protocol is monitored. - **NOTE:** The Exclude failed authentications with ‘N-2’ passwords option requires a GPO + :::note + The Exclude failed authentications with ‘N-2’ passwords option requires a GPO within the organization be configured to ‘Enforce password history’ with a setting of a minimum of ‘3 passwords remembered’ or it will not have an effect. + ::: + - _Optional:_ Scope the accounts to include in or exclude from being monitored on the AD Perpetrator filter. diff --git a/docs/threatprevention/7.4/admin/analytics/goldenticket.md b/docs/threatprevention/7.4/admin/analytics/goldenticket.md index 6d92ad2c65..9d507d45a1 100644 --- a/docs/threatprevention/7.4/admin/analytics/goldenticket.md +++ b/docs/threatprevention/7.4/admin/analytics/goldenticket.md @@ -12,14 +12,14 @@ authenticates, the ticket is checked against the maximum ticket lifetime and max configured within this analytic type. Any ticket that exceeds either ‘maximum’ will trigger an incident. -| Golden Tickets | | -| -------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -| Definition | Kerberos tickets with modified maximum lifetimes for a user ticket and maximum lifetimes for a user ticket renewal | -| Example | Kerberos tickets are used as a sort of “pass card” to obtain access to resources. Once a domain controller authenticates a user, a TGT (ticket granting ticket) is granted with a limited lifespan. This is then used to obtain TGS (ticket granting service) and the TGS is what identifies a user to a resource on the network. On TGT expiry, the user account is checked for validity (password, enabled/disabled, group memberships, etc.) and a new TGT is granted. A known vulnerability exists where a domain admin could forge the TGT renewal time, creating an indefinite “golden” ticket. This could be accomplished, and then the underlying account removed, allowing the user to obtain admin access forever with an account that no longer exists. If a user on the network were to attempt to use such a ticket, this analytic would detect the altered ticket and generate an alert. | -| Trigger | Maximum lifetime for a user ticket > than X hours OR Maximum lifetime for a user ticket renewal > Y days | -| Recommended Settings | Netwrix recommends configuring this analytic to trigger a hit if the maximum lifetime for a user ticket is greater than 24 hours or the maximum lifetime for a user ticket renewal is greater than 30 days. | +| Golden Tickets | | +| -------------------- | --------------- | +| Definition | Kerberos tickets with modified maximum lifetimes for a user ticket and maximum lifetimes for a user ticket renewal | +| Example | Kerberos tickets are used as a sort of “pass card” to obtain access to resources. Once a domain controller authenticates a user, a TGT (ticket granting ticket) is granted with a limited lifespan. This is then used to obtain TGS (ticket granting service) and the TGS is what identifies a user to a resource on the network.
On TGT expiry, the user account is checked for validity (password, enabled/disabled, group memberships, etc.) and a new TGT is granted. A known vulnerability exists where a domain admin could forge the TGT renewal time, creating an indefinite “golden” ticket. This could be accomplished, and then the underlying account removed, allowing the user to obtain admin access forever with an account that no longer exists. If a user on the network were to attempt to use such a ticket, this analytic would detect the altered ticket and generate an alert. | +| Trigger | Maximum lifetime for a user ticket > than X hours
OR
Maximum lifetime for a user ticket renewal > Y days | +| Recommended Settings | Netwrix recommends configuring this analytic to trigger a hit if the maximum lifetime for a user ticket is greater than 24 hours or the maximum lifetime for a user ticket renewal is greater than 30 days. | -Analytic Workflow +**Analytic Workflow** 1. Configure the analytic policy 2. Enable the analytic policy @@ -44,7 +44,7 @@ The Configure Analytics window has two tabs: - Policy – Where filters can be added, additional actions configured, a custom schedule set, and the policy enabled -Settings Tab +**Settings Tab** ![Golden Ticket Analytic Type - Settings tab](/img/product_docs/threatprevention/7.4/admin/analytics/goldenticketsettings.webp) @@ -54,7 +54,7 @@ tickets is ten hours, and the renewal period is seven days. This analytic policy ticket that requests authentication against the values set in this analytic policy. Any time a ticket exceeds either of these values, an incident is triggered. -Policy Tab +**Policy Tab** ![Golden Ticket Analytic Type - Policy tab](/img/product_docs/threatprevention/7.4/admin/analytics/policytab.webp) @@ -70,14 +70,20 @@ The **Policy** tab for configuring analytics consists of three sub-tabs: [Authentication Monitoring Event Type](/docs/threatprevention/7.4/admin/policies/configuration/eventtype/authenticationmonitoring.md) is hard coded, and the Success filter cannot be modified. - **_RECOMMENDED:_** Do not configure any filters for this analytic type. + :::info + Do not configure any filters for this analytic type. + ::: + - _Optional:_ Scope the protocol to be monitored on the Authentication Protocol filter. If enabling the analytic on a domain controller, also scope the login type. - **NOTE:** The Exclude failed authentications with ‘N-2’ passwords option requires a GPO + :::note + The Exclude failed authentications with ‘N-2’ passwords option requires a GPO within the organization be configured to ‘Enforce password history’ with a setting of a minimum of ‘3 passwords remembered’ or it will not have an effect. + ::: + - \_Optional:\_Scope the domains to be included in or excluded from monitoring on the Domains/Servers filter. @@ -87,9 +93,12 @@ The **Policy** tab for configuring analytics consists of three sub-tabs: Addresses (from) filter, the IP Addresses (to) filter, the Hosts (from) filter, or the Hosts (to) filter. - **NOTE:** Some authentication events may return only a host name (NetBIOS or FQDN), others + :::note + Some authentication events may return only a host name (NetBIOS or FQDN), others may return only an IP address. It is recommended to take this into account when entering filter values. + ::: + - Actions tab – Configured the same way a regular policy’s [Actions Tab](/docs/threatprevention/7.4/admin/policies/configuration/actions/overview.md) diff --git a/docs/threatprevention/7.4/admin/analytics/horizontalmovementattacks.md b/docs/threatprevention/7.4/admin/analytics/horizontalmovementattacks.md index 0a84da6443..2aba35cf7b 100644 --- a/docs/threatprevention/7.4/admin/analytics/horizontalmovementattacks.md +++ b/docs/threatprevention/7.4/admin/analytics/horizontalmovementattacks.md @@ -9,8 +9,11 @@ sidebar_position: 90 The **Horizontal Movement Attacks** analytic type identifies security principals that are accessing more than the threshold of resources during the specified time interval. -**_RECOMMENDED:_** Configure a subset of accounts and/or servers to be monitored in order to avoid +:::info +Configure a subset of accounts and/or servers to be monitored in order to avoid the excessive volume of event activity from monitoring all. +::: + | Horizontal Movement Attacks | | | --------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | @@ -19,7 +22,7 @@ the excessive volume of event activity from monitoring all. | Trigger | Successful or failed authentications of a given account across X number of resources in Y minutes | | Recommended Settings | Configure this analytic to trigger a hit if Threat Prevention monitors successful or failed authentications of a given account across 10 resources in 3 minutes. | -Analytic Workflow +**Analytic Workflow** 1. Configure the analytic policy 2. Enable the analytic policy @@ -45,7 +48,7 @@ The Configure Analytics window has two tabs: - Policy – Where filters can be added, additional actions configured, a custom schedule set, and the policy enabled -Settings Tab +**Settings Tab** ![Horizontal Movement Attacks Analytic Type - Settings tab](/img/product_docs/threatprevention/7.4/admin/analytics/horizontalattackssettings.webp) @@ -62,7 +65,7 @@ memory once they are more than 24 hours old. If checked, the Ignore failed logins for unresolved user names option will exclude bad user IDs from contributing to Horizontal Movement Attacks incidents. -Policy Tab +**Policy Tab** ![Horizontal Movement Attacks Analytic Type - Policy tab](/img/product_docs/threatprevention/7.4/admin/analytics/policytab.webp) @@ -82,9 +85,12 @@ The **Policy** tab for configuring analytics consists of three sub-tabs: - \_Optional:\_Scope the protocol to be monitored on the Authentication Protocol filter. If enabling the analytic on a domain controller, also scope the login type. - **NOTE:** The Exclude failed authentications with ‘N-2’ passwords option requires a GPO + :::note + The Exclude failed authentications with ‘N-2’ passwords option requires a GPO within the organization be configured to ‘Enforce password history’ with a setting of a minimum of ‘3 passwords remembered’ or it will not have an effect. + ::: + - \_Optional:\_Scope the domains to be included in or excluded from monitoring on the Domains/Servers filter. @@ -92,9 +98,12 @@ The **Policy** tab for configuring analytics consists of three sub-tabs: Addresses (from) filter, the IP Addresses (to) filter, the Hosts (from) filter, or the Hosts (to) filter. - **NOTE:** Some authentication events may return only a host name (NetBIOS or FQDN), others + :::note + Some authentication events may return only a host name (NetBIOS or FQDN), others may return only an IP address. It is recommended to take this into account when entering filter values. + ::: + - Actions tab – Configured the same way a regular policy’s [Actions Tab](/docs/threatprevention/7.4/admin/policies/configuration/actions/overview.md) @@ -120,7 +129,10 @@ The top data grid includes the following information for each incident: - Attacking Account Name – Security principal of the account that triggered the incident - **NOTE:** The name will be red if the attacking account is the Administrator account. + :::note + The name will be red if the attacking account is the Administrator account. + ::: + - Attacking Account SID – Security Identifier of the account used in the event - First Attempt – Date timestamp of the first monitored event that triggered the incident. Hover diff --git a/docs/threatprevention/7.4/admin/analytics/impersonationlogins.md b/docs/threatprevention/7.4/admin/analytics/impersonationlogins.md index 43d85b5437..1605aa13e8 100644 --- a/docs/threatprevention/7.4/admin/analytics/impersonationlogins.md +++ b/docs/threatprevention/7.4/admin/analytics/impersonationlogins.md @@ -9,8 +9,11 @@ sidebar_position: 100 The **Impersonation Logins** analytic type identifies multiple authenticated accounts from a single system within the specified time frame. -**_RECOMMENDED:_** Configure a subset of accounts and/or servers to be monitored in order to avoid +:::info +Configure a subset of accounts and/or servers to be monitored in order to avoid the excessive volume of event activity from monitoring all. +::: + | Impersonation Logins | | | -------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | @@ -19,7 +22,7 @@ the excessive volume of event activity from monitoring all. | Trigger | X different authenticated accounts from a single system in Y hours | | Recommended Settings | Netwrix recommends configuring this analytic to trigger a hit if Threat Prevention monitors 3 different authenticated accounts from a single system in 2 hours. | -Analytic Workflow +**Analytic Workflow** 1. Configure the analytic policy 2. Enable the analytic policy @@ -44,7 +47,7 @@ The Configure Analytics window has two tabs: - Policy – Where filters can be added, additional actions configured, a custom schedule set, and the policy enabled -Settings Tab +**Settings Tab** ![Impersonation Logins Analytic Type - Settings tab](/img/product_docs/threatprevention/7.4/admin/analytics/concurrentloginssettings.webp) @@ -58,7 +61,7 @@ triggered, an incident record is saved to the database along with the events tha incident. Raw authentication event data that did not contribute to an incident are purged from memory once they are more than 24 hours old. -Policy Tab +**Policy Tab** ![Impersonation Logins Analytic Type - Policy tab](/img/product_docs/threatprevention/7.4/admin/analytics/policytab.webp) @@ -77,9 +80,12 @@ The **Policy** tab for configuring analytics consists of three sub-tabs: - _Optional:_ Scope the protocol to be monitored on the Authentication Protocol filter. If enabling the analytic on a domain controller, also scope the login type. - **NOTE:** The Exclude failed authentications with ‘N-2’ passwords option requires a GPO + :::note + The Exclude failed authentications with ‘N-2’ passwords option requires a GPO within the organization be configured to ‘Enforce password history’ with a setting of a minimum of ‘3 passwords remembered’ or it will not have an effect. + ::: + - _Optional:_ – Scope the domains to be included in or excluded from monitoring on the Domains/Servers filter. @@ -89,9 +95,12 @@ The **Policy** tab for configuring analytics consists of three sub-tabs: Addresses (from) filter, the IP Addresses (to) filter, the Hosts (from) filter, or the Hosts (to) filter. - **NOTE:** Some authentication events may return only a host name (NetBIOS or FQDN), others + :::note + Some authentication events may return only a host name (NetBIOS or FQDN), others may return only an IP address. It is recommended to take this into account when entering filter values. + ::: + - Actions tab – Configured the same way a regular policy’s [Actions Tab](/docs/threatprevention/7.4/admin/policies/configuration/actions/overview.md) diff --git a/docs/threatprevention/7.4/admin/analytics/kerberosweakencryption.md b/docs/threatprevention/7.4/admin/analytics/kerberosweakencryption.md index 5843486fa3..32468ec6e7 100644 --- a/docs/threatprevention/7.4/admin/analytics/kerberosweakencryption.md +++ b/docs/threatprevention/7.4/admin/analytics/kerberosweakencryption.md @@ -10,14 +10,14 @@ The **Kerberos Weak Encryption** analytic type identifies Kerberos tickets with encryption by detecting the use of weak encryption. Various attack methods utilize weak Kerberos encryption cyphers, including Overpass-the-Hash. -| Kerberos Weak Encryption | | -| ------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| Definition | Kerberos tickets with RC4_HMAC_MD5 encryption. | -| Example | Kerberos tickets are used as a sort of “pass card” to obtain access to resources. Once a domain controller authenticates a user, a TGT (ticket granting ticket) is granted with a limited lifespan. This is then used to obtain TGS (ticket granting service) and the TGS is what identifies a user to a resource on the network. If RC4_HMAC_MD5 encryption is used then it makes possible to obtain password value using Kerberoasting attack. If a user on the network were to attempt to use such a ticket, this analytic would detect this ticket and generate an alert. | -| Trigger | Ticket uses RC4_HMAC_MD5 encryption. | -| Recommended Settings | No additional configuration is needed | +| Kerberos Weak Encryption | | +| ------------------------ | ---------------- | +| Definition | Kerberos tickets with RC4_HMAC_MD5 encryption. | +| Example | Kerberos tickets are used as a sort of “pass card” to obtain access to resources. Once a domain controller authenticates a user, a TGT (ticket granting ticket) is granted with a limited lifespan. This is then used to obtain TGS (ticket granting service) and the TGS is what identifies a user to a resource on the network.
If RC4_HMAC_MD5 encryption is used then it makes possible to obtain password value using Kerberoasting attack. If a user on the network were to attempt to use such a ticket, this analytic would detect this ticket and generate an alert. | +| Trigger | Ticket uses RC4_HMAC_MD5 encryption. | +| Recommended Settings | No additional configuration is needed | -Analytic Workflow +**Analytic Workflow** 1. Configure the analytic policy 2. Enable the analytic policy @@ -41,7 +41,7 @@ The Configure Analytics window has one tab: - Policy – Where filters can be added, additional actions configured, a custom schedule set, and the policy enabled -Policy Tab +**Policy Tab** ![Kerberos Weak Encryption Analytic Type - Policy tab](/img/product_docs/threatprevention/7.4/admin/analytics/policytab.webp) @@ -60,9 +60,12 @@ The **Policy** tab for configuring analytics consists of three sub-tabs: - Scope the servers to be included in or excluded from monitoring on the IP Addresses (from) filter, the IP Addresses (to) filter, the Hosts (from) filter, or the Hosts (to) filter. - **NOTE:** Some authentication events may return only a host name (NetBIOS or FQDN), others + :::note + Some authentication events may return only a host name (NetBIOS or FQDN), others may return only an IP address. It is recommended to take this into account when entering filter values. + ::: + - *Alternatively:* Scope the domains to be included in or excluded from monitoring on the Domains/Servers filter. @@ -70,9 +73,12 @@ The **Policy** tab for configuring analytics consists of three sub-tabs: enabling the analytic on a domain controller, also scope the login type. The Authentication Protocol filter is hard coded to ensure the Kerberos protocol is monitored. - **NOTE:** The Exclude failed authentications with ‘N-2’ passwords option requires a GPO + :::note + The Exclude failed authentications with ‘N-2’ passwords option requires a GPO within the organization be configured to ‘Enforce password history’ with a setting of a minimum of ‘3 passwords remembered’ or it will not have an effect. + ::: + - _Optional_ – Scope the accounts to include in or exclude from being monitored on the AD Perpetrator filter. diff --git a/docs/threatprevention/7.4/admin/analytics/overview.md b/docs/threatprevention/7.4/admin/analytics/overview.md index 9f9175cb9e..7127563af2 100644 --- a/docs/threatprevention/7.4/admin/analytics/overview.md +++ b/docs/threatprevention/7.4/admin/analytics/overview.md @@ -39,8 +39,11 @@ In the middle of the interface, you can view a list of the analytic types, numbe identified in the last 24 hours per type, the ability to enable or disable monitoring, access to the analytic configuration, and a tool tip with a brief summary of the analytic. -**_RECOMMENDED:_** For most analytics, configure at least one filter before enabling an analytic +:::info +For most analytics, configure at least one filter before enabling an analytic type. +::: + The Refresh button on the Analytics ribbon repopulates both the graphical display and the analytic list. diff --git a/docs/threatprevention/7.4/admin/analytics/useraccounthacking.md b/docs/threatprevention/7.4/admin/analytics/useraccounthacking.md index 77878d3a68..c7bb73067e 100644 --- a/docs/threatprevention/7.4/admin/analytics/useraccounthacking.md +++ b/docs/threatprevention/7.4/admin/analytics/useraccounthacking.md @@ -9,17 +9,20 @@ sidebar_position: 120 The **User Account Hacking** analytic type identifies multiple bad passwords provided for a given valid user account in the specified time interval. -**_RECOMMENDED:_** Configure a subset of accounts to be monitored in order to avoid the excessive +:::info +Configure a subset of accounts to be monitored in order to avoid the excessive volume of event activity from monitoring all accounts. +::: -| User Account Hacking | | -| -------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -| Definition | Repeated failed logins below lockout thresholds and/or over extended periods | -| Example | Malware or a bad actor on the network is attempting to compromise an account by guessing the account’s password repeatedly until access is granted. To circumvent built-in lockout policies in Active Directory, the malware or bad actor will only guess so many times before backing off, making sure not to lockout the account. After a period of time has expired, it will continue its routine until the password is guessed correctly. This type of attack is easily automated using a script. The quiet nature of this type of attack often results in the attack going undetected. \*The Enterprise Admin account (SID ending in -500) in Active Directory cannot be locked out making it vulnerable to hacking and eventual breach. While Active Directory will show the account is locked out on the object itself, as soon as the correct password is supplied, the account will be automatically unlocked, giving the perpetrator “God-rights” to the enterprise. | -| Trigger | (X1 failed login attempts from an individual user account in Y1 minutes) OR (X2 failed login attempts from an individual user account in Y3 minutes) OR … | -| Recommended Settings | Set the number of attempts 1 or 2 increments below the organization’s Active Directory lockout policy settings. | -Analytic Workflow +| User Account Hacking | | +| -------------------- | ---------------------- | +| Definition | Repeated failed logins below lockout thresholds and/or over extended periods | +| Example | Malware or a bad actor on the network is attempting to compromise an account by guessing the account’s password repeatedly until access is granted. To circumvent built-in lockout policies in Active Directory, the malware or bad actor will only guess so many times before backing off, making sure not to lockout the account. After a period of time has expired, it will continue its routine until the password is guessed correctly. This type of attack is easily automated using a script. The quiet nature of this type of attack often results in the attack going undetected.
\*The Enterprise Admin account (SID ending in -500) in Active Directory cannot be locked out making it vulnerable to hacking and eventual breach. While Active Directory will show the account is locked out on the object itself, as soon as the correct password is supplied, the account will be automatically unlocked, giving the perpetrator “God-rights” to the enterprise. | +| Trigger | (X1 failed login attempts from an individual user account in Y1 minutes) OR (X2 failed login attempts from an individual user account in Y3 minutes) OR … | +| Recommended Settings | Set the number of attempts 1 or 2 increments below the organization’s Active Directory lockout policy settings. | + +**Analytic Workflow** 1. Configure the analytic policy 2. Enable the analytic policy @@ -44,7 +47,7 @@ The Configure Analytics window has two tabs: - Policy – Where filters can be added, additional actions configured, a custom schedule set, and the policy enabled -Settings Tab +**Settings Tab** ![User Account Hacking Analytic Type - Settings tab](/img/product_docs/threatprevention/7.4/admin/analytics/accounthackingsettings.webp) @@ -71,7 +74,7 @@ Perpetrator** filter. If checked, the **Ignore failed logins for unresolved user names** option will exclude bad user IDs from contributing to User Account Hacking incidents. -Policy Tab +**Policy Tab** ![User Account Hacking Analytic Type - Policy tab](/img/product_docs/threatprevention/7.4/admin/analytics/policytab.webp) @@ -91,9 +94,12 @@ The **Policy** tab for configuring analytics consists of three sub-tabs: - _Optional_: Scope the protocol to be monitored on the Authentication Protocol filter. If enabling the analytic on a domain controller, also scope the login type. - **NOTE:** The Exclude failed authentications with ‘N-2’ passwords option requires a GPO + :::note + The Exclude failed authentications with ‘N-2’ passwords option requires a GPO within the organization be configured to ‘Enforce password history’ with a setting of a minimum of ‘3 passwords remembered’ or it will not have an effect. + ::: + - _Optional_: Scope the domains to be included in or excluded from monitoring on the Domains/Servers filter. @@ -101,9 +107,12 @@ The **Policy** tab for configuring analytics consists of three sub-tabs: Addresses (from) filter, the IP Addresses (to) filter, the Hosts (from) filter, or the Hosts (to) filter. - **NOTE:** Some authentication events may return only a host name (NetBIOS or FQDN), others + :::note + Some authentication events may return only a host name (NetBIOS or FQDN), others may return only an IP address. It is recommended to take this into account when entering filter values. + ::: + - Actions tab – Configured the same way a regular policy’s [Actions Tab](/docs/threatprevention/7.4/admin/policies/configuration/actions/overview.md) @@ -129,7 +138,10 @@ The top data grid includes the following information for each incident: - Attacked Account Name – Security principal of the account that triggered the incident - **NOTE:** The name will be red if the attacking account is the Administrator account. + :::note + The name will be red if the attacking account is the Administrator account. + ::: + - Attacked Account SID – Security Identifier of the account used in the event - First Attempt – Date timestamp of the first monitored event that triggered the incident. Hover diff --git a/docs/threatprevention/7.4/admin/configuration/collectionmanager/dynamic.md b/docs/threatprevention/7.4/admin/configuration/collectionmanager/dynamic.md index 2eecf0f337..1694307c21 100644 --- a/docs/threatprevention/7.4/admin/configuration/collectionmanager/dynamic.md +++ b/docs/threatprevention/7.4/admin/configuration/collectionmanager/dynamic.md @@ -57,14 +57,17 @@ following requirements: Example table entry for domain: -ExampleDomain +**ExampleDomain** Example table entry for server: -ExampleServer +**ExampleServer** -**NOTE:** Threat Prevention creates an empty table with the required prefix and schema if the [Table +:::note +Threat Prevention creates an empty table with the required prefix and schema if the [Table name] entered does not exist in the NVMonitorConfig database. +::: + ## Dynamic Objects Collection Table Requirements @@ -81,10 +84,13 @@ requirements: Example table entry: -CN=User,DC=Domain,DC=Local +**CN=User,DC=Domain,DC=Local** -**NOTE:** Threat Prevention creates an empty table with the required prefix and schema if the [Table +:::note +Threat Prevention creates an empty table with the required prefix and schema if the [Table name] entered does not exist in the NVMonitorConfig database. +::: + ## Dynamic Perpetrators Collections Table Requirements @@ -95,19 +101,23 @@ must meet the following requirements: - Table Naming Convention – Must have a prefix of ‘dc*perpetrators*’ - Table Schema – Must have the following columns: -| Column Name | Column Type | Column Description | -| -------------- | --------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| AccountName | NVARCHAR (1024) | Distinguished name of the account. Cannot be null. | -| AccountSid | NVARCHAR (184) | SDDL form of the account Security ID. Cannot be null. | -| AccountType | INT | Account type using the following values: - 0 = none - 1 = user - 2 = group - 3 = context - 4 = orgRole - 5 = sidtype - 6 = other - 7 = dynamic - 8 = dynamic_group Cannot be null. | -| IncludeSubtree | INT | Indicates if child containers should be used: - 0 = Child containers NOT included - 1 = Child containers included Cannot be null. | +| Column Name | Column Type | Column Description | +| -------------- | --------------- | ---------------------- | +| AccountName | NVARCHAR (1024) | Distinguished name of the account. Cannot be null. | +| AccountSid | NVARCHAR (184) | SDDL form of the account Security ID. Cannot be null. | +| AccountType | INT | Account type using the following values: Cannot be null. | +| IncludeSubtree | INT | Indicates if child containers should be used: Cannot be null. | + Example table entry: -CN=User,DC=Domain,DC=Local | S-1-5-21-1004336348-1177238915-682003330-500 | 3 | 0 +**CN=User,DC=Domain,DC=Local | S-1-5-21-1004336348-1177238915-682003330-500 | 3 | 0** -**NOTE:** Threat Prevention creates an empty table with the required prefix and schema if the [Table +:::note +Threat Prevention creates an empty table with the required prefix and schema if the [Table name] entered does not exist in the NVMonitorConfig database. +::: + ## Dynamic IP Addresses Collection Table Requirements @@ -126,8 +136,11 @@ Example table entry: 192.168.1.3 -**NOTE:** Threat Prevention creates an empty table with the required prefix and schema if the [Table +:::note +Threat Prevention creates an empty table with the required prefix and schema if the [Table name] entered does not exist in the NVMonitorConfig database. +::: + ## Dynamic Hosts Collection Table Requirements @@ -149,18 +162,21 @@ requirements: Example table entry with all fields populated: -host | host.dc.com | 10.0.10.19 | fe80::4d72:80e9:72cf:425f%10 +**host | host.dc.com | 10.0.10.19 | fe80::4d72:80e9:72cf:425f%10** Example table entry tjat excludes IP v6 Address: -host | host.dc.com | 10.0.10.19 | [null] +**host | host.dc.com | 10.0.10.19 | [null]** Example table entry that excludes IP v4 Address: -host | host.dc.com | [null]  | fe80::4d72:80e9:72cf:425f%10 +**host | host.dc.com | [null]  | fe80::4d72:80e9:72cf:425f%10** -**NOTE:** Threat Prevention creates an empty table with the required prefix and schema if the [Table +:::note +Threat Prevention creates an empty table with the required prefix and schema if the [Table name] entered does not exist in the NVMonitorConfig database. +::: + ## Dynamic File Paths Collection Table Requirements @@ -171,18 +187,22 @@ requirements: - Table Naming Convention – Must have a prefix of 'dc*file_path*' - Table Schema – Must have the following columns: -| Column Name | Column Type | Column Description | -| -------------- | --------------- | ------------------------------------------------------------------------------------ | -| Path | NVARCHAR (1024) | File path to the desired folder. Cannot be null. | -| IncludeSubtree | INT | Indicates whether or not subfolders are processed: - 0 = Not Included - 1 = Included | -| TargetAgent | NVARCHAR (1024) | Agent that monitors the target server. Cannot be null. | +| Column Name | Column Type | Column Description | +| -------------- | --------------- | ---------------------------------------------------------------------------------------------------------- | +| Path | NVARCHAR (1024) | File path to the desired folder. Cannot be null. | +| IncludeSubtree | INT | Indicates whether or not subfolders are processed: | +| TargetAgent | NVARCHAR (1024) | Agent that monitors the target server. Cannot be null. | + Example table entry: -c:\Windows | 0 | ExampleFSserver +**c:\Windows | 0 | ExampleFSserver** -**NOTE:** Threat Prevention creates an empty table with the required prefix and schema if the [Table +:::note +Threat Prevention creates an empty table with the required prefix and schema if the [Table name] entered does not exist in the NVMonitorConfig database. +::: + Two tables are created during the installation/upgrade process for the File Path collections: diff --git a/docs/threatprevention/7.4/admin/configuration/collectionmanager/listcollections.md b/docs/threatprevention/7.4/admin/configuration/collectionmanager/listcollections.md index 2d7a67930d..c4dfae5c0c 100644 --- a/docs/threatprevention/7.4/admin/configuration/collectionmanager/listcollections.md +++ b/docs/threatprevention/7.4/admin/configuration/collectionmanager/listcollections.md @@ -115,9 +115,12 @@ settings. **Step 1 –** Select a collection on the List of Collections window and click **Remove**. -**NOTE:** You cannot delete a collection that is assigned to an active policy, as indicated in the +:::note +You cannot delete a collection that is assigned to an active policy, as indicated in the Dependency Count column. Remove a collection from all policies it has been assigned to before deleting it. +::: + ![Confirm Removal window](/img/product_docs/threatprevention/7.4/admin/configuration/collectionmanager/confirmremoval.webp) diff --git a/docs/threatprevention/7.4/admin/configuration/collectionmanager/overview.md b/docs/threatprevention/7.4/admin/configuration/collectionmanager/overview.md index 6350ec4d46..f664a4f77c 100644 --- a/docs/threatprevention/7.4/admin/configuration/collectionmanager/overview.md +++ b/docs/threatprevention/7.4/admin/configuration/collectionmanager/overview.md @@ -51,49 +51,50 @@ Select a collection category and click **Manage…** i to open the Threat Prevention has the following pre-configured Collections: -| Collection Type | Name | -| --------------------- | --------------------------------------------------------- | -| Domains and Servers | SBServers | -| Objects | Administrator Accounts | -| Objects | Administrator Groups | -| Objects | Sensitive Groups | -| Objects | Service Accounts | -| Perpetrators | Administrative Accounts | -| Perpetrators | Domain Administrators | -| Perpetrators | Failed Authentications | -| Perpetrators | Service Accounts | -| Perpetrators | Successful Authentications | -| Perpetrators | Successful HIPPAA PHI Account Authentications | -| Perpetrators | System Accounts | -| Lockdown Perpetrators | Allow Perpetrators | -| Lockdown Perpetrators | Critical GPO - Allow Perpetrators | -| Lockdown Perpetrators | DNS Records - Allow Perpetrators | -| Lockdown Perpetrators | GPOs - Allow  Perpetrators | -| Lockdown Perpetrators | Group Lockdown - Allow Perpetrators | +| Collection Type | Name | +| --------------------- | ------------------- | +| Domains and Servers | SBServers | +| Objects | Administrator Accounts | +| Objects | Administrator Groups | +| Objects | Sensitive Groups | +| Objects | Service Accounts | +| Perpetrators | Administrative Accounts | +| Perpetrators | Domain Administrators | +| Perpetrators | Failed Authentications | +| Perpetrators | Service Accounts | +| Perpetrators | Successful Authentications | +| Perpetrators | Successful HIPPAA PHI Account Authentications | +| Perpetrators | System Accounts | +| Lockdown Perpetrators | Allow Perpetrators | +| Lockdown Perpetrators | Critical GPO - Allow Perpetrators | +| Lockdown Perpetrators | DNS Records - Allow Perpetrators | +| Lockdown Perpetrators | GPOs - Allow  Perpetrators | +| Lockdown Perpetrators | Group Lockdown - Allow Perpetrators | | Lockdown Perpetrators | Group User OU Object Delete and Move - Allow Perpetrators | -| Lockdown Perpetrators | Object Permissions - Allow Perpetrators | -| Lockdown Perpetrators | OU Structure - Allow Perpetrators | -| Lockdown Perpetrators | Root Object - Allow Perpetrators | -| Lockdown Perpetrators | User Lockdown - Allow Perpetrators | -| Classes | Exclude Classes | -| Classes | Threat Manager - AD Excluded Classes | -| Attributes | Exclude Attributes | -| Attributes | Exclude User Attributes | -| Attributes | Property Set: DNS-Host-Name-Attributes | -| Attributes | Property Set: Domain-Other-Parameters | -| Attributes | Property Set: Domain-Password | -| Attributes | Property Set: General-Information | -| Attributes | Property Set: Membership | -| Attributes | Property Set: Personal-Information | -| Attributes | Property Set: Private-Information | -| Attributes | Property Set: Public-Information | -| Attributes | Property Set: RAS-Information | -| Attributes | Property Set: Terminal-Server-License-Server | -| Attributes | Property Set: User-Account-Restrictions | -| Attributes | Property Set: User-Login | -| Attributes | Property Set: Web-Information | -| Attributes | Threat Manager - AD Excluded Attributes | -| Hosts | Domain Controllers | -| Hosts | Exchanges Servers | -| File Paths | Folders with Sensitive Data. If you | -| File Paths | Open Shares | +| Lockdown Perpetrators | Object Permissions - Allow Perpetrators | +| Lockdown Perpetrators | OU Structure - Allow Perpetrators | +| Lockdown Perpetrators | Root Object - Allow Perpetrators | +| Lockdown Perpetrators | User Lockdown - Allow Perpetrators | +| Classes | Exclude Classes | +| Classes | Threat Manager - AD Excluded Classes | +| Attributes | Exclude Attributes | +| Attributes | Exclude User Attributes | +| Attributes | Property Set: DNS-Host-Name-Attributes | +| Attributes | Property Set: Domain-Other-Parameters | +| Attributes | Property Set: Domain-Password | +| Attributes | Property Set: General-Information | +| Attributes | Property Set: Membership | +| Attributes | Property Set: Personal-Information | +| Attributes | Property Set: Private-Information | +| Attributes | Property Set: Public-Information | +| Attributes | Property Set: RAS-Information | +| Attributes | Property Set: Terminal-Server-License-Server | +| Attributes | Property Set: User-Account-Restrictions | +| Attributes | Property Set: User-Login | +| Attributes | Property Set: Web-Information | +| Attributes | Threat Manager - AD Excluded Attributes | +| Hosts | Domain Controllers | +| Hosts | Exchanges Servers | +| File Paths | Folders with Sensitive Data. If you | +| File Paths | Open Shares | + diff --git a/docs/threatprevention/7.4/admin/configuration/databasemaintenance/enable.md b/docs/threatprevention/7.4/admin/configuration/databasemaintenance/enable.md index 1583e37105..a1cc03f165 100644 --- a/docs/threatprevention/7.4/admin/configuration/databasemaintenance/enable.md +++ b/docs/threatprevention/7.4/admin/configuration/databasemaintenance/enable.md @@ -9,8 +9,11 @@ sidebar_position: 10 Database maintenance can be enabled for all or specific event types, analytics, and/or policies. It can be enabled for any combination of event type data, analytic data, and policy data. -_Remember,_ the Event Type maintenance settings take precedence over Policy maintenance settings +:::tip +Remember, the Event Type maintenance settings take precedence over Policy maintenance settings where the selected policy employs that event type. +::: + Follow the steps to enable database maintenance. diff --git a/docs/threatprevention/7.4/admin/configuration/databasemaintenance/overview.md b/docs/threatprevention/7.4/admin/configuration/databasemaintenance/overview.md index d268d5fe4c..34e32ba717 100644 --- a/docs/threatprevention/7.4/admin/configuration/databasemaintenance/overview.md +++ b/docs/threatprevention/7.4/admin/configuration/databasemaintenance/overview.md @@ -12,9 +12,12 @@ per Event Type, per Analytics, and/or per Policy. While all three options can be different operations and retention periods, the Event Type maintenance settings take precedence over Policy maintenance settings where the selected policy employs that event type. -_Remember,_ See the Database Maintenance Permission details in the +:::tip +Remember, See the Database Maintenance Permission details in the [Database Maintenance Feature Requirements](/docs/threatprevention/7.4/requirements/sqlserver/dbmaintenance.md) topic for additional information. +::: + See the [Stored Procedures](/docs/threatprevention/7.4/admin/configuration/databasemaintenance/storedprocedures.md) @@ -77,12 +80,15 @@ topic for additional information. **Step 5 –** Click **Save** to save the changes. -**_RECOMMENDED:_** The SQL Server databases should be configured to use 'Simple Recovery Mode' in +:::info +The SQL Server databases should be configured to use 'Simple Recovery Mode' in the [SQL Server Requirements](/docs/threatprevention/7.4/requirements/sqlserver/sqlserver.md). This configuration has a direct impact on the size of the transaction log during database maintenance delete tasks. If Simple Recovery Mode is not configured on the databases, the transaction log may get quite large during delete tasks. +::: + ## Event Type Tab diff --git a/docs/threatprevention/7.4/admin/configuration/databasemaintenance/storedprocedures.md b/docs/threatprevention/7.4/admin/configuration/databasemaintenance/storedprocedures.md index a5dd510660..af6a2c09ba 100644 --- a/docs/threatprevention/7.4/admin/configuration/databasemaintenance/storedprocedures.md +++ b/docs/threatprevention/7.4/admin/configuration/databasemaintenance/storedprocedures.md @@ -11,16 +11,17 @@ databases. See the [Database Maintenance Window](/docs/threatprevention/7.4/admin/configuration/databasemaintenance/overview.md) topic for additional information. -| Name | When Threat Prevention Uses the Procedure | What the Stored Procedure Does | -| ------------------------ | ----------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -| DeleteAuthAnalytics | Called from the SQLAgent job if the “Delete” operation is selected for database maintenance for Authentication Analytics. | This stored procedure deletes “old” data from the database in the following tables: - A_Login - A_Login2Policy - AR_BruteForceAttacks - AR_UserAccountHackingAttacks - AR_HorizontalMovementAttacks - AR_BadUserIdByUser - AR_BadUserIdByHost - AR_BreachedPassword - AR_ConcurrentLogins - AR_DiamondPAC - AR_EventTracker - AR_ImpersonationLogins - AR_GoldenTickets - AR_KerberosWeakEncryption | -| DeleteByPolicy | Called from the SQLAgent job if the “Delete” operation is selected for database maintenance for selected policies. | This stored procedure deletes “old” data from the database in the following tables: - NvEvent - NvEvent_EventTracker - AttributeValue - OldAttributeValue - EventPolicy - E_LDAP - E_LDAP_EventTracker - E_LDAP2Policy | -| DeleteFSAnalytics | Called from the SQLAgent job if the “Delete” operation is selected for database maintenance File System Analytics. | This stored procedure deletes “old” data from the database in the following tables: - A_FS - A_FS2Policy - AR_FilesPerUser - AR_EventTracker | -| Delete LDAP | Called from the SQL Agent job if the “Delete” operation is selected for database maintenance for the LDAP Event Type. | This stored procedure deletes “old” data from the database in the following tables: - E_LDAP - E_LDAP_EventTracker - E_LDAP2Policy | -| DeleteNvEventByEventType | Called from the SQL Agent job if the “Delete” operation is selected for database maintenance for all Event Types except LDAP. | This stored procedure deletes “old” data from the database in the following tables: - NvEvent - NvEvent_EventTracker - AttributeValue - OldAttributeValue - EventPolicy | -| MoveAuthAnalytics | Called from the SQLAgent job if the “Move” operation is selected for database maintenance for Authentication Analytics. | This stored procedure moves “old” data from one database to another in the following tables: - A_Login - A_Login2Policy - AR_BruteForceAttacks - AR_UserAccountHackingAttacks - AR_HorizontalMovementAttacks - AR_BadUserIdByUser - AR_BadUserIdByHost - AR_BreachedPassword - AR_ConcurrentLogins - AR_DiamondPAC - AR_EventTracker - AR_ImpersonationLogins - AR_GoldenTickets - AR_KerberosWeakEncryption | -| MoveByPolicy | Called from the SQLAgent job if the “Move” operation is selected for database maintenance for selected policies. | This stored procedure moves “old” database from one database to another in the following tables: - NvEvent - NvEvent_EventTracker - AttributeValue - OldAttributeValue - EventPolicy - E_LDAP - E_LDAP_EventTracker - E_LDAP2Policy | -| MoveFSAnalytics | Called from the SQLAgent job if the “Move” operation is selected for database maintenance for File System Analytics. | This stored procedure moves “old” data from one database into another in the following tables: - A_FS - A_FS2Policy - AR_FilesPerUser - AR_EventTracker | -| Move LDAP | Called from the SQLAgent job if the “Move” operation is selected for database maintenance for LDAP Event Type. | This stored procedure moves “old” data from one database into another in the following tables: - E_LDAP - E_LDAP_EventTracker - E_LDAP2Policy | -| MoveNvEventsByEventType | Called from the SQLAgent job if the “Move” operation is selected for database maintenance for all Event Types except LDAP. | This stored procedure moves “old” data from one database to another in the following tables: - NvEvent - NvEvent_EventTracker - AttributeValue - OldAttributeValue - EventPolicy | -| RdbPolicyCopy | Called from the SQLAgent job if the “Move” operation is selected for database maintenance. | This stored procedure creates a copy of the RdbPolicy table in the target database. | +| Name | When Threat Prevention Uses the Procedure | What the Stored Procedure Does | +| ------------------------ | ----------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| DeleteAuthAnalytics | Called from the SQLAgent job if the “Delete” operation is selected for database maintenance for Authentication Analytics. | This stored procedure deletes “old” data from the database in the following tables: | +| DeleteByPolicy | Called from the SQLAgent job if the “Delete” operation is selected for database maintenance for selected policies. | This stored procedure deletes “old” data from the database in the following tables: | +| DeleteFSAnalytics | Called from the SQLAgent job if the “Delete” operation is selected for database maintenance File System Analytics. | This stored procedure deletes “old” data from the database in the following tables: | +| Delete LDAP | Called from the SQL Agent job if the “Delete” operation is selected for database maintenance for the LDAP Event Type. | This stored procedure deletes “old” data from the database in the following tables: | +| DeleteNvEventByEventType | Called from the SQL Agent job if the “Delete” operation is selected for database maintenance for all Event Types except LDAP. | This stored procedure deletes “old” data from the database in the following tables: | +| MoveAuthAnalytics | Called from the SQLAgent job if the “Move” operation is selected for database maintenance for Authentication Analytics. | This stored procedure moves “old” data from one database to another in the following tables: | +| MoveByPolicy | Called from the SQLAgent job if the “Move” operation is selected for database maintenance for selected policies. | This stored procedure moves “old” database from one database to another in the following tables: | +| MoveFSAnalytics | Called from the SQLAgent job if the “Move” operation is selected for database maintenance for File System Analytics. | This stored procedure moves “old” data from one database into another in the following tables: | +| Move LDAP | Called from the SQLAgent job if the “Move” operation is selected for database maintenance for LDAP Event Type. | This stored procedure moves “old” data from one database into another in the following tables: | +| MoveNvEventsByEventType | Called from the SQLAgent job if the “Move” operation is selected for database maintenance for all Event Types except LDAP. | This stored procedure moves “old” data from one database to another in the following tables: | +| RdbPolicyCopy | Called from the SQLAgent job if the “Move” operation is selected for database maintenance. | This stored procedure creates a copy of the RdbPolicy table in the target database. | + diff --git a/docs/threatprevention/7.4/admin/configuration/epesettings.md b/docs/threatprevention/7.4/admin/configuration/epesettings.md index 02a49fea16..b787a40581 100644 --- a/docs/threatprevention/7.4/admin/configuration/epesettings.md +++ b/docs/threatprevention/7.4/admin/configuration/epesettings.md @@ -31,7 +31,10 @@ the environment: Prior to deploying the HIBP database, consider the pros and cons when choosing its deployment location. It can be deployed on the Threat Prevention Agent and/or the Enterprise Manager machine. -_Remember,_ both the Agent and the Enterprise Manager can be in one environment. +:::tip +Remember, both the Agent and the Enterprise Manager can be in one environment. +::: + If the HIBP database is copied to and stored on the Agent: @@ -64,7 +67,10 @@ If the HIBP database is kept only on the Enterprise Manager: Click **Configuration > EPE Settings** on the menu to open the EPE Settings window. -**NOTE:** The EPE Settings window is only available to Threat Prevention administrators. +:::note +The EPE Settings window is only available to Threat Prevention administrators. +::: + ![EPE Settings window](/img/product_docs/threatprevention/7.4/admin/configuration/epesettings.webp) @@ -78,16 +84,22 @@ Manager for the first time. It displays the source from where the database was d version, and the number of hashes it contains. It also shows a thumbprint value that changes whenever the content of the Hash DB changes. -_Remember,_ the HIBP dataset is updated at random intervals by its publisher. It can go weeks or +:::tip +Remember, the HIBP dataset is updated at random intervals by its publisher. It can go weeks or even months with no changes. +::: + ### Check for Update Options The Check for Update options area specifies when the Netwrix website is checked for a new version of the HIBP database. -**NOTE:** These options are enabled after the HIBP database has been deployed to Enterprise Manager +:::note +These options are enabled after the HIBP database has been deployed to Enterprise Manager for the first time. +::: + Configure the following options: @@ -100,7 +112,10 @@ Configure the following options: HIBP database. If only this option is selected, then an alert is generated in the Administration Console when a new version is detected. - **NOTE:** This checkbox does not automatically download the new HIBP database version. + :::note + This checkbox does not automatically download the new HIBP database version. + ::: + - Update pwned DB on new version – Checks the Netwrix website for HIBP updates and then updates the Enterprise Manager server if a new version is detected @@ -113,18 +128,24 @@ intervals. Threat Prevention utilizes the Passwords Hash database to check if users’ new and pending password (i.e. during a password reset) matches the hash of a compromised password from a data breach. -**NOTE:** First-time configuration of this window requires downloading the HIBP database from the +:::note +First-time configuration of this window requires downloading the HIBP database from the Netwrix website. If the Administration Console does not have internet access, see the [Download and Configure the Have I Been Pwnd Hash List](#download-and-configure-the-have-i-been-pwnd-hash-list) topic for instructions. +::: + -**CAUTION:** Ensure the initial update of the database occurs during non-office hours. Due to the +:::warning +Ensure the initial update of the database occurs during non-office hours. Due to the size of the hash file, this download takes up a significant amount of CPU and download time. +::: + - Passwords Hash Database Folder (path on Threat Prevention Server) – Central location of the Pwned database on the application server. The default path is: - …\Netwrix\Netwrix Treat Prevention\SIEnterpriseManager\PwnedStore +**…\Netwrix\Netwrix Treat Prevention\SIEnterpriseManager\PwnedStore** - Update Type: @@ -133,10 +154,13 @@ size of the hash file, this download takes up a significant amount of CPU and do instead of downloading the full HIBP database. This option is enabled after a full download of the HIBP database has completed. - **NOTE:** Only the full HIBP database file obtained from the Netwrix website has version + :::note + Only the full HIBP database file obtained from the Netwrix website has version information. That full HIBP database file can be obtained using the Website option. Alternately, the HIBP database can be obtained outside of the application by downloading it directly from the Netwrix website using an FTP connection: + ::: + - [https://releases.netwrix.com/resources/stealthintercept/stealthintercept-hibp-database-1.0.0.zip](https://releases.netwrix.com/resources/stealthintercept/stealthintercept-hibp-database-1.0.0.zip) - [https://releases.netwrix.com/resources/stealthintercept/stealthintercept-hibp-database-1.0.0.zip.sha256.txt](https://releases.netwrix.com/resources/stealthintercept/stealthintercept-hibp-database-1.0.0.zip.sha256.txt) @@ -184,7 +208,10 @@ messages regardless of their location. Supported languages include: - Spanish - Thai -_Remember,_ the module must be deployed to end user computers. +:::tip +Remember, the module must be deployed to end user computers. +::: + The User Feedback Module section has the following checkboxes: @@ -233,8 +260,11 @@ The Password Dictionary window is a global setting used across all EPE policies. centralized copy of the dictionary.dat file. This modifiable file contains all compromised passwords. You can add, remove, and modify passwords in the list. -_Remember,_ for the password to be rejected, the user pending password must match exactly to a +:::tip +Remember, for the password to be rejected, the user pending password must match exactly to a password in the Password Dictionary list. +::: + Click the **Modify Passwords Dictionary** button in the Rules area on the EPE Settings window. The Password Dictionary window is displayed. @@ -288,7 +318,10 @@ The Substitutions Editor window is a global setting used across all EPE policies substitutions and their associated replacements are stored in this editor as rules (i.e. A = @). The Words List Dictionary applies these rules when checking all permutations of a user entered password. -**NOTE:** All entries in the sequence column must be unique. +:::note +All entries in the sequence column must be unique. +::: + For example: If “Goal” is added to the Word List Dictionary and A=@ and O=0 are added to the substitutions editor, then the pending passwords of “Go@l” and “G0al” will be blocked. @@ -306,7 +339,10 @@ The Substitutions Editor has the following options: installation. Any modifications are discarded. - Insert – Displays a custom row for the user to enter Sequence and Replacement values - **NOTE:** The new row is inserted underneath the current highlighted row. + :::note + The new row is inserted underneath the current highlighted row. + ::: + - Delete – Removes a single row from the Substitutions Editor list. Only one row can be deleted at a time. @@ -323,15 +359,18 @@ The Pwnd Passwords Downloader is a Dotnet tool used to download all Pwned Passwo save them offline so they can be used without a dependency on the k-anonymity API. Use this tool to get the latest breached hashes from the Have I Been Pwnd (HIBP) database. -**NOTE:** The +:::note +The [](https://github.com/HaveIBeenPwned/PwnedPasswordsDownloader)[Pwnd Passwords Downloader](https://github.com/HaveIBeenPwned/PwnedPasswordsDownloader) is a third party, open source tool, created by the HaveIBeenPwned team and distributed under a BSD 3-Clause License. You might experience issues during the hash download process, depending on your threading settings or the load on the CloudFlare backend. The Pwnd Passwords Downloader tool will automatically retry to continue downloading the hashes until it fully completes the download process. +::: + -Prerequisites +**Prerequisites** The Pwnd Passwords Downloader has the following prerequisite: @@ -343,7 +382,7 @@ The Pwnd Passwords Downloader has the following prerequisite: The Have I Been Pwnd database (HIBP) hashes can take up to 30 GB. Make sure that you have enough free space on your disk. -Install the Pwnd Passwords Downloader +**Install the Pwnd Passwords Downloader** Follow the steps to install the Pwnd Passwords Downloader. @@ -360,7 +399,7 @@ dotnet tool install --global haveibeenpwned-downloader **Step 3 –** Close the command prompt. -Update an Installed Pwnd Passwords Downloader +**Update an Installed Pwnd Passwords Downloader** Follow the steps to update an installed Pwnd Passwords Downloader. @@ -374,7 +413,7 @@ dotnet tool update --global haveibeenpwned-downloader ![hibp_installation_1](/img/product_docs/accessanalyzer/11.6/admin/datacollector/passwordsecurity/hibp_installation_1.webp) -Download NTML Hashes with the Pwnd Passwords Downloader +**Download NTML Hashes with the Pwnd Passwords Downloader** Follow the steps to download NTLM hashes. diff --git a/docs/threatprevention/7.4/admin/configuration/eventfilteringconfiguration.md b/docs/threatprevention/7.4/admin/configuration/eventfilteringconfiguration.md index 5beeaccf99..a3bcf25ffa 100644 --- a/docs/threatprevention/7.4/admin/configuration/eventfilteringconfiguration.md +++ b/docs/threatprevention/7.4/admin/configuration/eventfilteringconfiguration.md @@ -10,7 +10,10 @@ The Event Filtering Configuration window enables you to exclude specific Active Authentication events from being monitored. A latency threshold can be set to generate alerts for AD events. -**NOTE:** This window is only available to Threat Prevention administrators. +:::note +This window is only available to Threat Prevention administrators. +::: + Follow the steps to enable event filtering. @@ -27,11 +30,17 @@ To disable a filter for diagnostic purposes, simply uncheck its checkbox and cli Click the Help icon (?) for an option in the AD Global Pre Filters area to view the type of “noise” events being filtered. -**NOTE:** All Authentication Global Pre Filters options require configuration before they can be +:::note +All Authentication Global Pre Filters options require configuration before they can be enabled. +::: + -**_RECOMMENDED:_** Enable all the AD Global Pre Filters options as well as the Exclude Logins from +:::info +Enable all the AD Global Pre Filters options as well as the Exclude Logins from Machine Accounts option in the Authentication Global Pre Filters section. +::: + When activated, the Agent filters out the event data according to configurations defined in the filters.json file located in the installation directory of the Enterprise Manager. @@ -108,7 +117,7 @@ Select one of the following radio buttons to apply to the list of account names: Repeat the process until all machine accounts to be included or excluded from Authentication event data have been entered in the list. Then click **OK**. -Usage Tip +**Usage Tip** Windows Server 2012 introduced gMSA (Group Managed Service Accounts). gMSA accounts include “$” in their names, so by default Threat Prevention filters out authentication traffic generated by these accounts because they ‘look’ like machine accounts which prior to Server 2012 were the only account names ending in “$”. @@ -145,7 +154,7 @@ The Exclude Authentication Events from Selected Accounts option is disabled by d requires configuration before it can be enabled. Click the selected accounts link to open the Edit Collection window. -![Edit Collection window - For Selected Accounts](/img/product_docs/threatprevention/7.4/admin/configuration/editcollectionaccounts.webp) +![Edit Collection window - For Selected Accounts](/img/product_docs/threatprevention/7.4/admin/configuration/editcollectionaccounts_1.webp) The Exclude Authentication Events from Selected Accounts collection is only accessible through the Event Filtering Configuration window. Use the **Add** (+) button to open the diff --git a/docs/threatprevention/7.4/admin/configuration/filemonitorsettings.md b/docs/threatprevention/7.4/admin/configuration/filemonitorsettings.md index a9c99daf8c..a0c58df547 100644 --- a/docs/threatprevention/7.4/admin/configuration/filemonitorsettings.md +++ b/docs/threatprevention/7.4/admin/configuration/filemonitorsettings.md @@ -76,8 +76,11 @@ to browse for and select AD accounts. Any accounts added to the list are excluded globally from File System activity. -**NOTE:** If the **Exclude selected processes** option is checked, any file activity generated by +:::note +If the **Exclude selected processes** option is checked, any file activity generated by the processes added will have their File System activity ignored. +::: + ## Select Local Processes to Exclude diff --git a/docs/threatprevention/7.4/admin/configuration/systemalerting/email.md b/docs/threatprevention/7.4/admin/configuration/systemalerting/email.md index 797c29d0d6..6e74f9d591 100644 --- a/docs/threatprevention/7.4/admin/configuration/systemalerting/email.md +++ b/docs/threatprevention/7.4/admin/configuration/systemalerting/email.md @@ -53,7 +53,10 @@ recipients of the selected Message Profiles. Follow the steps to configure the SMTP host information for email alerting. -_Remember,_ this is a one-time setting to enable email alerts from the Administration Console. +:::tip +Remember, this is a one-time setting to enable email alerts from the Administration Console. +::: + ![System Alerting window - Email tab - Configure SMTP Host and Message Profile](/img/product_docs/threatprevention/7.4/admin/configuration/systemalerting/smtphost.webp) @@ -82,8 +85,11 @@ checkbox and provide a username and password in the boxes that appear. Message Profiles are associated with events for email alerting. Follow the steps to create a Message Profile. -**NOTE:** When the Message Profile is modified for an alert, all policies referencing the alert use +:::note +When the Message Profile is modified for an alert, all policies referencing the alert use the updated information. +::: + ![System Alerting window - Email tab - Configure SMTP Host and Message Profile](/img/product_docs/threatprevention/7.4/admin/configuration/systemalerting/smtphost.webp) @@ -95,7 +101,10 @@ Alerting window opens. **Step 3 –** In the Message Profiles area, click the **Add** (+) button to create a Message Profile. The default profile name (New Email Notification) is displayed. -**_RECOMMENDED:_** Provide a unique and descriptive name for this new email notification profile. +:::info +Provide a unique and descriptive name for this new email notification profile. +::: + **Step 4 –** Choose between **Plain Text** and **HTML** email options. The Email Template window displays when selecting either radio button. @@ -163,9 +172,12 @@ The available Event Data Fields and their associated tokens are: | Old Attribute Values | %OLD_ATTRIBUTE_VALUE% | | Attribute Operations | %OPERATION% | -**CAUTION:** The tokens used within the message Body, the information between and including the % +:::warning +The tokens used within the message Body, the information between and including the % symbols (e.g. %TIME_STAMP%), must be present to retrieve that event data from the database. Tokens can be removed, but partial tokens do not retrieve data from the database. +::: + **Step 9 –** Click **OK** to save the settings. diff --git a/docs/threatprevention/7.4/admin/configuration/systemalerting/overview.md b/docs/threatprevention/7.4/admin/configuration/systemalerting/overview.md index 154053ccf1..30e4b29fb3 100644 --- a/docs/threatprevention/7.4/admin/configuration/systemalerting/overview.md +++ b/docs/threatprevention/7.4/admin/configuration/systemalerting/overview.md @@ -14,7 +14,7 @@ manage all alerting avenues. Click **Configuration** > **Alerts** on the menu to Alerts can be sent to recipients via email, to Windows Event Log, and to SIEM products. Alerts are grouped into five types: -Threat Prevention Security events +**Threat Prevention Security events** The Security type provides alerts on things that impact: @@ -22,21 +22,21 @@ The Security type provides alerts on things that impact: - The ability to collect the data - Changes to who can access it -Threat Prevention Operations events +**Threat Prevention Operations events** The Operations type provides alerts on internal operations of the product that are not directly influenced by a user. -Threat Prevention Configuration events +**Threat Prevention Configuration events** The Configuration type provides alerts on changes to general configuration settings. -Analytic incidents +**Analytic incidents** The Analytics type provides alerts when an analytic incident is triggered. These alerts are not available for Event Log alerts. -Policy events +**Policy events** The Policies type provides alerts when a policy monitors or blocks an event. These alerts are not available for Event Log alerts. @@ -87,10 +87,13 @@ Below are some considerations: Prevention administrator should check if the Agent service is set to manual start. The most likely solution is to upgrade to the latest version of the Agent. - **_RECOMMENDED:_** Activate an email notification for the _LSASS process terminated_ alert. See + :::info + Activate an email notification for the _LSASS process terminated_ alert. See the [Enable the 'LSASS Process Terminated' Email Alert](/docs/threatprevention/7.4/troubleshooting/lsass.md#enable-the-lsass-process-terminated-email-alert) topic for additional information. + ::: + - In addition to the LSASS process termination check, the Agent can be configured for a Safe Mode. In Safe Mode, the Agent records the version of the LSASS DLLs that it hooks into during @@ -103,8 +106,11 @@ Below are some considerations: [Start Pending Modules](/docs/threatprevention/7.4/admin/agents/agentmanagement/startpendingmodules.md) topic for additional information. - **_RECOMMENDED:_** Activate an email notification for this alert. See the + :::info + Activate an email notification for this alert. See the [Enable Agent Started in AD Monitor Pending Mode Email Alert](/docs/threatprevention/7.4/admin/agents/safemode.md#enable-agent-started-in-ad-monitor-pending-mode-email-alert) topic and the [Agent Safe Mode](/docs/threatprevention/7.4/admin/agents/safemode.md) topic for additional information. + + ::: diff --git a/docs/threatprevention/7.4/admin/configuration/systemalerting/siem.md b/docs/threatprevention/7.4/admin/configuration/systemalerting/siem.md index 79218c4dc2..35cef84982 100644 --- a/docs/threatprevention/7.4/admin/configuration/systemalerting/siem.md +++ b/docs/threatprevention/7.4/admin/configuration/systemalerting/siem.md @@ -64,7 +64,10 @@ Alerting window opens. **Step 2 –** In the SIEM Profiles area, click the Add (+) button to create a new SIEM profile. To rename the default text, select the name string and enter the new profile name. -**_RECOMMENDED:_** For each profile, use a unique name for easy identification. +:::info +For each profile, use a unique name for easy identification. +::: + **Step 3 –** Use the Protocol drop-down menu to select either protocol: @@ -105,7 +108,7 @@ of a policy or the [Actions Tab](/docs/threatprevention/7.4/admin/templates/configuration/actions.md) of a policy template. -IBM QRadar Integration +**IBM QRadar Integration** Netwrix has created a custom app for integration between Threat Prevention and QRadar. See the [Active Directory App for QRadar](/docs/threatprevention/7.4/siemdashboard/qradar/overview.md) @@ -114,7 +117,7 @@ data from either Threat Prevention or Netwrix Activity Monitor. See the [Netwrix Activity Monitor Documentation](https://helpcenter.netwrix.com/category/activitymonitor) for additional information. -Splunk Integration +**Splunk Integration** Netwrix has created custom apps for integration between Threat Prevention and Splunk. See the [Active Directory App for Splunk](/docs/threatprevention/7.4/siemdashboard/activedirectory/overview.md) @@ -131,7 +134,7 @@ Custom SIEM mapping files can be added. First create the mapping file, and save that the Administration Console can access. The default mapping files are stored in the following folder: -…\Netwrix\Netwrix Threat Prevention\SIWinConsole\SIEMTemplates\ +**…\Netwrix\Netwrix Threat Prevention\SIWinConsole\SIEMTemplates\** Follow the steps to add a custom SIEM mapping file. diff --git a/docs/threatprevention/7.4/admin/configuration/threatmanagerconfiguration.md b/docs/threatprevention/7.4/admin/configuration/threatmanagerconfiguration.md index 71f4f98c92..51f8441eb4 100644 --- a/docs/threatprevention/7.4/admin/configuration/threatmanagerconfiguration.md +++ b/docs/threatprevention/7.4/admin/configuration/threatmanagerconfiguration.md @@ -10,7 +10,7 @@ The Netwrix Threat Manager Configuration window is a global setting to enable in Threat Prevention and Threat Manager. This window is only available to Threat Prevention administrators. -Threat Manager App Token +**Threat Manager App Token** The Threat Manager App Token authenticates connection between Threat Prevention and Threat Manager. This token is generated in Threat Manager: @@ -42,7 +42,10 @@ and port in the following format. The default port for Threat Manager is **10001 - For an example with the host name – amqp://ExampleHost:10001 - For an example with the host address – amqp://192.168.9.52:10001 -**CAUTION:** Do not use localhost for the hostname or 127.0.0.1 for the IP address. +:::warning +Do not use localhost for the hostname or 127.0.0.1 for the IP address. +::: + **Step 4 –** In the App Token box, enter the App Token generated on the App Tokens page in Threat Manager. @@ -64,9 +67,12 @@ The following is displayed for each policy: All real-time event data from the selected Threat Prevention policies is now being sent to Threat Manager. -**NOTE:** The Threat Manager URI configuration can also be used to send Threat Prevention policy +:::note +The Threat Manager URI configuration can also be used to send Threat Prevention policy data to the Activity Monitor host and port (example: amqp://localhost:4499). Threat Prevention can only send to either Threat Manager or the Activity Monitor. +::: + ## Honey Token Tab diff --git a/docs/threatprevention/7.4/admin/configuration/userroles/add.md b/docs/threatprevention/7.4/admin/configuration/userroles/add.md index 9ef282c92b..c4142b9e2b 100644 --- a/docs/threatprevention/7.4/admin/configuration/userroles/add.md +++ b/docs/threatprevention/7.4/admin/configuration/userroles/add.md @@ -26,10 +26,13 @@ or Group list. Operator, are displayed. Select the checkbox for a role to assign it to the user. Checking Administrator automatically checks the Console Operator role. -_Remember,_ the Report User role was a legacy role for the IIS-based SI Reporting Console and does +:::tip +Remember, the Report User role was a legacy role for the IIS-based SI Reporting Console and does not apply to the Netwrix Threat Manager Reporting Module console. See the [User Access Page](/docs/threatprevention/7.4/reportingmodule/configuration/interface/useraccess.md) topic for information on granting report access. +::: + **Step 5 –** _(Optional)_ Create as many users as required before clicking OK. diff --git a/docs/threatprevention/7.4/admin/configuration/userroles/overview.md b/docs/threatprevention/7.4/admin/configuration/userroles/overview.md index 89459bf675..eb65606d87 100644 --- a/docs/threatprevention/7.4/admin/configuration/userroles/overview.md +++ b/docs/threatprevention/7.4/admin/configuration/userroles/overview.md @@ -15,7 +15,10 @@ Click **Configuration** > **Users** on the menu to open the Users and Roles wind ![Users and Roles window](/img/product_docs/threatprevention/7.4/admin/configuration/userroles/usersroleswindow.webp) -**NOTE:** This window is only available to Threat Prevention administrators. +:::note +This window is only available to Threat Prevention administrators. +::: + The user account that ran the installation is automatically set with the administrator role. This is the only active user until more are added. This ensures that no unauthorized accounts can open the @@ -29,12 +32,15 @@ There are two roles that can be applied to a Threat Prevention user: the [Administrator Permissions](#administrator-permissions) topic for additional information. - Console Operator – Can create and run policies, and view event data. -**NOTE:** The Report User role was a legacy feature for the IIS-based Reporting Console and is no +:::note +The Report User role was a legacy feature for the IIS-based Reporting Console and is no longer applicable. See the [Reporting Module](/docs/threatprevention/7.4/reportingmodule/overview.md) topic for information on the new reporting console. +::: + -Administration Console Rights +**Administration Console Rights** | | Administrator | Console Operator | | ----------------------------------------------------------- | ------------------------------- | ------------------------------- | diff --git a/docs/threatprevention/7.4/admin/investigate/datagrid.md b/docs/threatprevention/7.4/admin/investigate/datagrid.md index 265d775f9c..dd01114185 100644 --- a/docs/threatprevention/7.4/admin/investigate/datagrid.md +++ b/docs/threatprevention/7.4/admin/investigate/datagrid.md @@ -65,7 +65,10 @@ event: - File System monitoring/blocking – Original path of the affected file or folder - Authenticate – DN of the user object making the request - **NOTE:** For LDAP bind/monitoring/blocking, Affected Object Path is not used + :::note + For LDAP bind/monitoring/blocking, Affected Object Path is not used + ::: + - Agent: Domain – Active Directory domain where the Agent that monitored/blocked the event is deployed diff --git a/docs/threatprevention/7.4/admin/investigate/filters.md b/docs/threatprevention/7.4/admin/investigate/filters.md index dd03943aa6..c81eebf1c8 100644 --- a/docs/threatprevention/7.4/admin/investigate/filters.md +++ b/docs/threatprevention/7.4/admin/investigate/filters.md @@ -18,7 +18,7 @@ button to repopulate the data grid with the current information for the selected Filter categories are discussed below. -Policy +**Policy** To filter by Policy, check the checkboxes for the desired policy. Protected policies that the current user does not have rights to view are grayed-out. @@ -28,7 +28,7 @@ current user does not have rights to view are grayed-out. are included in the filter. By default, event data from deleted policies is not included with the investigation results. -Who +**Who** To filter by Who, check the Perpetrator box to filter for a particular security principal committing the change and/or check the Affected Object box to filter for a particular object being affected by @@ -50,7 +50,7 @@ For the Affected Object option, select the option button for either: Then enter the who in the textbox. Filter criteria can be a partial match. -When +**When** Filtering by When provides several options, including the option between using Local Time or UTC time. @@ -64,7 +64,7 @@ time. - To filter for Events for Last [number] Hours, check this box and set the number of hours to be used as the filter -Where +**Where** To filter by Where, check the box(es) for the desired filter type(s): @@ -78,7 +78,7 @@ To filter by Where, check the box(es) for the desired filter type(s): - To This Computer – Select the radio button for either Name or IP and then enter the computer in the textbox - Filter criteria can be a partial match +**Filter criteria can be a partial match** What @@ -87,7 +87,7 @@ To filter by What, check the box(es) for the desired filter type(s): - Event – Select the option button for either Success or Fail - Action Type – Select the option button for either Blocked or Not Blocked -Other +**Other** To filter by Other, check the box(es) for the desired filter type(s): @@ -101,9 +101,12 @@ To filter by Other, check the box(es) for the desired filter type(s): Filter criteria can be a partial match. -**CAUTION:** The Full Text Search is not driven by indexes. Unless other indexed criteria are +:::warning +The Full Text Search is not driven by indexes. Unless other indexed criteria are selected, the full text search could result in a scan of the entire SQL database which could be very slow for large databases. +::: + - Full Text Search – Queries the entire SQL database for the entered attribute. If the attribute displays anywhere in the event, it is displayed in the data grid. diff --git a/docs/threatprevention/7.4/admin/investigate/summaryfolders.md b/docs/threatprevention/7.4/admin/investigate/summaryfolders.md index c4605f7421..e8329f46f5 100644 --- a/docs/threatprevention/7.4/admin/investigate/summaryfolders.md +++ b/docs/threatprevention/7.4/admin/investigate/summaryfolders.md @@ -48,7 +48,7 @@ available below the report name: displays when an export option is selected. Provide a name for the report and save to a specified location. -Parameter Window +**Parameter Window** ![Parameter Window](/img/product_docs/threatprevention/7.4/admin/investigate/parameter.webp) diff --git a/docs/threatprevention/7.4/admin/navigation/datagrid.md b/docs/threatprevention/7.4/admin/navigation/datagrid.md index 60a6c8f208..c9a81ee0b5 100644 --- a/docs/threatprevention/7.4/admin/navigation/datagrid.md +++ b/docs/threatprevention/7.4/admin/navigation/datagrid.md @@ -63,22 +63,25 @@ per column. - Pin Icon [D] – Opens a filtration dialog that provides multiple types of filtration options such as  column values, text filters, and date filters associated with the column data -Auto Filter Row +**Auto Filter Row** The Auto Filter row is located between the header row and the first event of the data grid. Typing a single attribute in any of these boxes or selecting an attribute from a dropdown menu filters the data grid for matches within that column and the selected comparison operator. -**NOTE:** The Alerts grid does not display the Auto Filter Row by default. It must be selected +:::note +The Alerts grid does not display the Auto Filter Row by default. It must be selected through the grid’s Show Auto Filter Row option from the right-click menu. +::: -Filter Statement Bar + +**Filter Statement Bar** When a filter is enabled, the filter statement bar is displayed at the bottom of the display area. The X to the left of the bar clears the filter. The checkbox for the filter on the left affects the scoping of the filter. -Filter Editor +**Filter Editor** Notice the Edit Filter option on the right side of the filter statement bar. Click it to open the Filter Editor window, where you can build complex filter statements. It can employ multiple @@ -86,7 +89,7 @@ comparison operators and/or multiple column filters. ![Filter Editor](/img/product_docs/threatprevention/7.4/admin/navigation/filtereditor.webp) -Pin Icon +**Pin Icon** A small pin icon is displayed in the upper-right corner while hovering over a column header or if an Auto Filter Row filter is enabled. @@ -135,7 +138,10 @@ The data grids provide an option to export data. - Clicking the Export button from the Investigate interface or the Recent Events tab of a policy opens the Export window. -**NOTE:** Ensure that all desired filters are set on the data grid before export. +:::note +Ensure that all desired filters are set on the data grid before export. +::: + ![Export window](/img/product_docs/threatprevention/7.4/admin/navigation/export.webp) @@ -157,7 +163,10 @@ Locally and/or Email to and populate the required fields. distribution lists, or a combination. Use either a comma (,) or a semi-colon (;) to separate multiple recipients. Click Export to export the data. -**NOTE:** The Email to action requires the SMTP host Information to be configured. This can only be +:::note +The Email to action requires the SMTP host Information to be configured. This can only be done by a Threat Prevention administrator through the [Email Tab](/docs/threatprevention/7.4/admin/configuration/systemalerting/email.md) of the System Alerting window. + +::: diff --git a/docs/threatprevention/7.4/admin/navigation/licensemanager.md b/docs/threatprevention/7.4/admin/navigation/licensemanager.md index 5d7b0ade73..d462905a13 100644 --- a/docs/threatprevention/7.4/admin/navigation/licensemanager.md +++ b/docs/threatprevention/7.4/admin/navigation/licensemanager.md @@ -10,8 +10,11 @@ The License Manager window displays the Threat Prevention modules that you are l under an Enterprise license, it also displays an expiration date. On license expiry, the Enterprise Manager will refuse events from all Agents. -_Remember,_ if events are not received and displayed in the Administration Console, check if your +:::tip +Remember, if events are not received and displayed in the Administration Console, check if your license has expired. +::: + Click **Help > License Manager** on the menu. The Netwrix Threat Prevention License Manager window is displayed. @@ -24,20 +27,23 @@ Prevention solution. Following is a list of the solutions with their respective modules. You can also view the event types available with each module. -**NOTE:** The Password Enforcement module is available under all licenses for monitoring weak +:::note +The Password Enforcement module is available under all licenses for monitoring weak passwords. However, you need the Enterprise Password Enforcer solution license to block weak passwords. +::: + ## Active Directory Solution The Active Directory solution comes with the following licensed modules: -| Licensed Module | Available Event Type | -| ---------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| Active Directory Changes | Active Directory Changes Active Directory Read Monitoring AD Replication Monitoring Authentication Monitoring Effective Group Membership FSMO Role Monitoring LSASS Guardian – Monitor | -| Active Directory Lockdown \*Requires Active Directory Changes Module | Active Directory Lockdown AD Replication Lockdown Authentication Lockdown LSASS Guardian – Protect | -| GPO Lockdown \*Requires Active Directory Changes Module \*\*Requires File System Module | GPO Setting Lockdown | -| GPO Setting Changes \*Requires Active Directory Changes Module \*\*Requires File System Module | GPO Setting Changes | +| Licensed Module | Available Event Type | +| --------------------- | ------------------------------------- | +| Active Directory Changes | Active Directory Changes
Active Directory Read Monitoring
AD Replication Monitoring
Authentication Monitoring
Effective Group Membership
FSMO Role Monitoring
LSASS Guardian – Monitor | +| Active Directory Lockdown
\*Requires Active Directory Changes Module | Active Directory Lockdown
AD Replication Lockdown
Authentication Lockdown
LSASS Guardian – Protect | +| GPO Lockdown
\*Requires Active Directory Changes Module
\*\*Requires File System Module | GPO Setting Lockdown | +| GPO Setting Changes
\*Requires Active Directory Changes Module
\*\*Requires File System Module | GPO Setting Changes | See the following topics for additional information: @@ -74,7 +80,7 @@ The Exchange solution comes with the following licensed modules: | Licensed Module | Available Event Type | | ---------------------------------------------------------- | -------------------- | | Exchange Events Module | Exchange Changes | -| Exchange Lockdown Module \*Requires Exchange Events Module | Exchange Lockdown | +| Exchange Lockdown Module
\*Requires Exchange Events Module | Exchange Lockdown | See the following topics for additional information: @@ -87,7 +93,7 @@ The File System solution comes with the following licensed modules: | Licensed Module | Available Event Type | | ------------------ | ----------------------------------------------------------------------- | -| File System Module | File System Changes File System Lockdown File System Enterprise Auditor | +| File System Module | File System Changes
File System Lockdown
File System Enterprise Auditor | The File System Changes event type and File System Lockdown event type only generate event monitoring and blocking data for Threat Prevention. The File System Enterprise Auditor event type @@ -101,16 +107,16 @@ See the following topics for additional information: – For Windows file servers and/or NAS devices - [File System Lockdown Event Type](/docs/threatprevention/7.4/admin/policies/configuration/eventtype/filesystemlockdown.md) – For Windows file servers -- [File System Enterprise Auditor Event Type](/docs/threatprevention/7.4/admin/policies/eventtype/filesystemaccessanalyzer.md) +- [File System Enterprise Auditor Event Type](/docs/threatprevention/7.4/admin/policies/configuration/eventtype/filesystemaccessanalyzer.md) – For Windows file servers ## LDAP Solution The LDAP solution comes with the following licensed modules: -| Licensed Module | Available Event Type | -| ----------------------------------------------------------------- | -------------------------------------------------- | -| LDAP Monitoring Module \*Requires Active Directory Changes Module | LDAP Lockdown LDAP Monitoring LDAP Bind Monitoring | +| Licensed Module | Available Event Type | +| --------------- | ---------- | +| LDAP Monitoring Module
\*Requires Active Directory Changes Module | LDAP Lockdown
LDAP Monitoring
LDAP Bind Monitoring | See the following topics for additional information: diff --git a/docs/threatprevention/7.4/admin/navigation/overview.md b/docs/threatprevention/7.4/admin/navigation/overview.md index f8cb1871b9..94630d1081 100644 --- a/docs/threatprevention/7.4/admin/navigation/overview.md +++ b/docs/threatprevention/7.4/admin/navigation/overview.md @@ -78,14 +78,17 @@ interface. The following interface options are available: - [Analytics Interface](/docs/threatprevention/7.4/admin/analytics/overview.md) - [Policies Interface](/docs/threatprevention/7.4/admin/policies/overview.md) - [Templates Interface](/docs/threatprevention/7.4/admin/templates/overview.md) -- [Tags Node](/docs/threatprevention/7.4/admin/overview_1.md) +- [Tags Node](/docs/threatprevention/7.4/admin/Tags.md) Several right-click menus and additional features are available within these interfaces. -_Remember,_ the Investigate, Analytics, Policies, Templates, and TAGS nodes in the Navigation pane +:::tip +Remember, the Investigate, Analytics, Policies, Templates, and TAGS nodes in the Navigation pane can be expanded and collapsed. +::: -Agents + +**Agents** The Agents interface provides data about the Agents within the environment. This includes what domain the Agent is in, what machine it is deployed on, its current status, and other details. This @@ -93,26 +96,26 @@ interface also indicates if a domain controller does NOT have an Agent deployed interface, Agents can be deployed, updated, and managed; logging levels can be configured; logs can be accessed; and Agent information can be exported. -Alerts +**Alerts** The Alerts interface provides information on the Threat Prevention Security events, Operations events, and Configuration events. All events are displayed by default. However, they can be filtered, sorted, and searched. -Investigate +**Investigate** The Investigate interface is a reporting tool for the Administration Console. It provides information on recent events monitored or blocked by any enabled policy. By default, all events recently monitored or blocked are available. However, they can be filtered to particular policies, perpetrators, time frames, domains, servers, computers, events, etc. -Analytics +**Analytics** The Analytics interface is a front-line warning tool for detecting incidents in real-time based on patterns within collected event data indicative of potential security risk. It provides information on incidents identified by the analytic policies. -Policies +**Policies** The Policies interface provides a central location for creating and configuring all policies. On selecting the Policy node, the policies are listed in the Display area. In the Navigation pane, the @@ -126,14 +129,14 @@ A folder can be protected, which controls access to any policy within the folder cannot be viewed, edited, or deleted by other Administration Console users without explicit permissions being granted. -Templates +**Templates** The Templates interface provides a central location for creating and configuring all policy templates. On selecting the Templates node, a list of all policy templates available is displayed in the Display area. Policy templates must also be stored within a folder. There are pre-created policy templates which can be imported. -TAGS +**TAGS** The TAGS node provides an organizational feature for templates. Many preconfigured templates have tags which enable users to quickly find a desired template though various groupings. Tags do not diff --git a/docs/threatprevention/7.4/admin/navigation/rightclickmenus.md b/docs/threatprevention/7.4/admin/navigation/rightclickmenus.md index 9c05d97a4e..26cc3aa05e 100644 --- a/docs/threatprevention/7.4/admin/navigation/rightclickmenus.md +++ b/docs/threatprevention/7.4/admin/navigation/rightclickmenus.md @@ -9,7 +9,7 @@ sidebar_position: 10 In the Navigation pane, the Policies node, Templates node, folders, policies, and templates have different right-click commands available. -Alerts Node +**Alerts Node** From the Agents node, the right-click menu can be used to install the Agent. @@ -19,7 +19,7 @@ From the Agents node, the right-click menu can be used to install the Agent. | ------------------- | ----------------------------------------------------------------------------------------------------------------- | | Install Agent | Opens the [Deploy Agents Wizard](/docs/threatprevention/7.4/admin/agents/deploy/overview.md#deploy-agents-wizard) | -Saved ‘Filtered Investigate’ Nodes +**Saved ‘Filtered Investigate’ Nodes** From the node of a saved ‘Filtered Investigate’ view, the right-click menu allows you to delete the saved view. @@ -30,7 +30,7 @@ saved view. | ------------------- | --------------------------------------------- | | Delete | Deletes the saved ‘Filtered Investigate’ view | -Policies and Templates Nodes +**Policies and Templates Nodes** From the Policies and Templates nodes, the right-click menu is limited to adding new folders to the selected section. @@ -41,7 +41,7 @@ selected section. | --------------------- | --------------------------------------------- | | New — Folder (Crtl+F) | Creates a new folder in the selected location | -Folder Node +**Folder Node** From a Folder node, the right-click menu contains these commands. @@ -56,12 +56,14 @@ From a Folder node, the right-click menu contains these commands. | Remove | Deletes the selected folder | | Paste | Pastes a copied policy/template into the selected folder | -**NOTE:** If the logged in user does not have the **Manage Policies** permissions for a protected +:::note +If the logged in user does not have the **Manage Policies** permissions for a protected policy, these options are grayed-out. See the [Policies Interface](/docs/threatprevention/7.4/admin/policies/overview.md) topic for additional information on protection. +::: -`` and `