Default Set of Components
Individual Components
InTrust Deployment Manager
InTrust Manager
InTrust Server
InTrust Monitoring Console
InTrust Repository Viewer
InTrust Repository
Repository Indexing Tool
Supported Platforms
Microsoft Windows Events
Microsoft IIS Events
Microsoft Forefront Threat Management Gateway and ISA Server Events
Microsoft DHCP Server Events
Solaris Events
Red Hat Enterprise Linux Events
Oracle Linux Events
SUSE Linux Events
Debian GNU/Linux Events
Ubuntu Linux Events
VMware vCenter Events
VMware ESX and ESXi Events
Minimal Rights and Permissions Required for InTrust Operations
Microsoft Forefront Threat Management Gateway and ISA Server Events
Server side:
- InTrust Server
- Microsoft Microsoft TMG Management Console for data gathering without agents
Processed computer:
| Architecture | x86 |
| Microsoft Forefront Threat Management Gateway or ISA Server | Any of the following:
|
| Additional Software and Services |
|
Rights and permissions for data gathering with agents:
The following rights and permissions must be assigned to the InTrust agent account if the agent is not running under the LocalSystem account:
- Read permission to the server (or server array) configuration
- Read permission to the
HKLM\SYSTEM\CurrentControlSet\Control\TimeZoneInformation registry key - Read and List Folder Contents permissions to log file folders; the Delete permission must also be granted if the Clear log after gathering option is turned on for the data source
Requirements for gathering Threat Management Gateway logs in SQL Server Express format without agents:
- RPC connections to the Threat Management Gateway server must be allowed.
- The SQL Server instance named "MSFW" on the Threat Management Gateway server must be made remotely available.
- The Microsoft TMG Management Console must be installed on the InTrust server.
|
|
Note: For more information about job and task accounts, ee the Understanding Jobs and Tasks topic and Minimal Rights and Permissions Required for InTrust Operations. |
Microsoft DHCP Server Events
Server side:
- InTrust Server
Processed computer:
| Architecture |
|
| Operating System | Any of the following:
|
| Microsoft DHCP Server | N/A |
| Additional Software and Services |
|
Rights and permissions for data gathering without agents:
- Access this computer from the network right
- Deny access to this computer from network right must be disabled
- Read permission to the
HKLM\SYSTEM\CurrentControlSet\Services\DHCPServer\Parameters registry key - Read permission to the
HKLM\SYSTEM\CurrentControlSet\Control\TimeZoneInformation registry key - Read permission to the
HKLM\SYSTEM\CurrentControlSet\Control\Nls\Language registry key - Membership in the local Administrators group
- Read and List Folder Contents permissions to log file folders; the Delete permission must also be granted if the Clear log after gathering option is turned on for the data source
Rights and permissions for data gathering with agents:
- Read permission to the
HKLM\SYSTEM\CurrentControlSet\Services\DHCPServer\Parameters registry key - Read permission to the
SYSTEM\CurrentControlSet\Control\TimeZoneInformation registry key - Read and List Folder Contents permissions to log file folders; the Delete permission must also be granted if the Clear log after gathering option is turned on for the data source
|
|
Note: For more information about job and task accounts, see the Understanding Jobs and Tasks topic and Minimal Rights and Permissions Required for InTrust Operations. |
Solaris Events
Server side:
- InTrust Server
Processed computer:
| Architecture |
|
| Operating System | Any of the following:
|
|
|
Note: If a non-UTF-8 locale is used, the following patches should be installed:
|
Red Hat Enterprise Linux Events
Server side:
- InTrust Server
Processed computer:
| Architecture | Any of the following:
|
| Operating System | Any of the following:
|
| Additional Software |
This note applies only to Red Hat Enterprise Linux 6 and later. The InTrust agent is a 32-bit application, so the following dependencies must be installed on 64-bit editions of the operating system:
On Red Hat Enterprise Linux 8, the libnsl.i686 library must also be installed. |