• Diventare un professionista del portale
• Scaricare
• Stampa
• I miei download ()

• Supporto
• Documentazione tecnica
• Change Auditor Threat Detection 7.1.1
• Change Auditor Threat Detection 7.1.1 - Deployment Guide

Change Auditor Threat Detection 7.1.1 - Deployment Guide

Table of Contents  

Deploying Threat Detection

Introduction to Change Auditor Threat Detection

Who should have input on the deployment plan? Components and workflow

Requirements and prerequisites Events to configure Port Requirements Maintaining the Change Auditor database size Deploying a Threat Detection server on ESX Deploying a Threat Detection server on Hyper-V

Hyper-V resource control settings

Upgrading the Threat Detection server

Upgrade from Change Auditor version 7.0.2

Update-CAThreatDetectionServer

Upgrade from Change Auditor version 7.0 and 7.0.1

Upload the update package to the Threat Detection server Upgrade the Threat Detection server Join the Threat Detection server to the coordinator's domain Configure the service account

Creating a Threat Detection configuration Reviewing configuration status

Configured server deployment details

Removing a configuration Historical events and your baseline calculations

Threat Detection configuration commands

Adding the PowerShell module Viewing available commands and help Threat Detection sample scripts Connecting to Change Auditor

Connect-CAClient

Managing a Threat Detection configuration

New-CAThreatDetectionConfiguration Get-CAThreatDetectionConfiguration Set-CAThreatDetectionConfiguration Remove-CAThreatDetectionConfiguration

Appendix: System Architecture

Threat Detection system overview

• Viewing Topics 33 - 36 of 37

×

Get-CAThreatDetectionConfiguration

Use this command to view the Threat Detection configuration information and information about the associated subscription.

Table 3. Available parameters

Parameter	Description
-Connection	A connection obtained by using the Connect-CAClient command. See Connecting to Change Auditor.

Example: Review Threat Detection configuration details

Get-CAThreatDetectionConfiguration -Connection $connection

Command output

The command returns the following information. For more information about some of these settings see the Change Auditor SIEM Integration Guide.

Table 4. Available configuration information

Setting	Description
TDServer	The Threat Detection server fully qualified domain name.
ConfigurationState	State of the configuration: • Configured: Threat Detection has been configured • Unconfigured: Threat Detection has not been configured • A valid Change Auditor Threat Detection license is required
HistoricalDays	How many days of historical events have been sent to Threat Detection server.
TDServerStatus	Status of the Threat Detection server: • Online • Offline
DataProcessingStatus	Status of the data processing. For example, building baseline.
TDServerVersion	Threat Detection server version.
TDSubscriptionId	Threat Detection subscription ID.
StartTime	Starting point in time for events to send.
Subsystems	Subsystems that have been selected for event sending.
TDSubscriptionEnabled	Whether the Threat Detection subscription is enabled.
NotificationInterval	How often how often (in milliseconds) events are sent.
HeartbeatInterval	Interval (in milliseconds) that a heartbeat check is made for the configuration.
BatchSize	Batch size. The maximum number of events to include in a single notification message.
NotificationUrl	Url for notifications.
HeartbeatUrl	Url for heartbeat notifications.
LastEventTime	When the last event was sent.
LastEventResponse	Last event response (For example OK, HTTP 429 - Too many events being sent, and HTTP 401 - Unauthorized access.)
LastHeartbeatTime	When the last heartbeat was sent.
LastHeartbeatResponse	The last heartbeat response. (For example OK, HTTP 429 - Too many events being sent, and HTTP 401 - Unauthorized access.)
EventsSent	Number of events sent.
BatchesSent	Number of batches sent.
HeartbeatsSent	Number of heartbeats sent.
BookmarkTime	Time the last event was sent.
AllowedCoordinators	List of coordinators permitted to send events.
LastCoordinator	The coordinator that is sending events. If the subscription is disabled, this is the last coordinator that sent events.

Set-CAThreatDetectionConfiguration

Use this command to modify the list of allowed coordinators for the Threat Detection configuration.

Table 5. Available parameters

Parameter	Description
-Connection	A connection obtained by using the Connect-CAClient command. See Connecting to Change Auditor.
-AllowedCoordinators (Optional)	The DNS or NetBIOS name of the coordinators permitted to send events. If none are specified, all coordinators installed at the time of configuration are permitted to send events. NOTE: The list order does not determine which coordinator is selected to send events.

Example: Modifying a configuration

Set-CAThreatDetectionConfiguration -Connection $connection -AllowedCoordinators @('machine1.domain.com','machine2.domain.com')

Example: To clear a previous list of allowed coordinators

Set-CAThreatDetectionConfiguration -Connection $connection -AllowedCoordinators @()

Remove-CAThreatDetectionConfiguration

Use this command to remove a Threat Detection configuration.

NOTE:   Deleting the configuration only removes configuration information from Change Auditor. It does not remove data or configuration on the Threat Detection server. • If you are removing the configuration as a part of a clean up process, you can delete the Threat Detection server after removing configuration. • If you are removing the configuration and plan to start over, you can either revert to a snapshot from a previously deployed (but not configured) Threat Detection server or deploy a new Threat Detection server. • When you join the server to the domain during configuration, Change Auditor creates a computer and service account in the domain required for Integrated Windows Authentication. The computer and service account must be removed from the domain when a configuration is removed.

Table 6. Available parameters

Parameter	Description
-Connection	A connection obtained by using the Connect-CAClient command. See Connecting to Change Auditor.

Example: Remove the Threat Detection configuration

Remove-CAThreatDetectionConfiguration -Connection $connection

Appendix: System Architecture

•	Threat Detection system overview

•  Precedente
• Viewing Topics 33 - 36 of 37
• Successiva 

Cerca in questo documento Cerca in tutti i documenti

×

 Questo è il portale del supporto

Puoi trovare aiuto e supporto online per Quest *prodotto* sul sito di supporto di un affiliato. Fai clic su Continua per essere reindirizzato ai contenuti e all'assistenza corretti per *prodotto*.

Related Documents

The document was helpful.

Seleziona valutazione

I easily found the information I needed.

Seleziona valutazione

© ALL RIGHTS RESERVED. Termini di utilizzo Privacy Cookie Preference Center