InTrust 11.6.1 - Preparing for Auditing Microsoft Forefront Threat Management Gateway and ISA Server

Gathering Data Without Agents

You can configure InTrust to collect ISA Server 2000 logs without agents.

• To work without agents, Microsoft ISA Administrative Components must be installed on the InTrust server.
• On the processed computer, you can use Remote Registry Service, or Microsoft ISA Administrative Components.
• The account under which the gathering service will access site computers (specified explicitly in the site’s settings, or inherited from InTrust server or task) requires the following:
  1. Access this computer from the network right must be granted.
  2. Deny access to this computer from network right must be disabled.
  3. Membership in the local Administrators group.
  4. Read permission to the HKLM\SYSTEM\CurrentControlSet\Control\TimeZoneInformation registry key.
  5. Read permission to the HKLM\SYSTEM\CurrentControlSet\Control\Nls\Language registry key.
  6. Read and List Folder Contents permissions to log file folders; the Delete permission must also be granted if the Clear log files after gathering option is enabled for the data source.

Resolution of IP Addresses

If specified by InTrust settings, IP addresses found in the log are resolved to host names, and InTrust saves them both (IP addresses and host names) into the log, appending them to original fields. This can significantly slow down gathering process; that is why this option is disabled by default. If necessary, you can enable this option in the following way:

1. In InTrust Manager, select Configuration | Data Sources.
2. On the right pane, select the ISA Server log you need, for example, Web Proxy Log.
3. From its shortcut menu, select Properties, on the Settings tab select Resolve IP addresses to and specify whether to resolve them into NetBIOS names or DNS names.

InTrust Knowledge Pack for Microsoft ISAS/Proxy Server

The Knowledge Pack for Microsoft ISAS/Proxy Server offers a set of predefined InTrust objects that will help you configure the gathering and monitoring of event data from your Microsoft TMG/ISA/Proxy Servers. The following objects are included:

• Gathering policies:
  • TMG and ISAS: Security
    Collects all TMG and ISAS security events to both a repository and a database.
  • TMG and ISAS: Health
    Collects all TMG and ISAS health events both to a repository and a database.
  • TMG and ISAS: Usage: Proxy
    Collects TMG and ISAS Web Proxy log both to a repository and a database.
  • TMG and ISAS: Usage: Firewall
    Collects TMG and ISAS Firewall log both to a repository and a database.
• Import policies:
  • TMG and ISAS: Security
    Imports all TMG and ISAS security events to a database.
  • TMG and ISAS: Health
    Imports all TMG and ISAS health events to a database.
  • TMG and ISAS: Usage: Proxy
    Imports events from TMG and ISAS Web Proxy log to a database.
  • TMG and ISAS: Usage: Firewall
    Imports events from TMG and ISAS Firewall log to a database.
• Jobs:
  • TMG and ISAS Security events collection
    Collection of all the TMG and ISAS security events to the default repository and the default database.
  • Weekly TMG and ISAS Web Proxy Reporting
    Weekly reporting of TMG and ISAS Web Proxy usage.
  • Weekly TMG and ISAS Firewall Reporting
    Weekly reporting of TMG and ISAS Firewall usage.
• Tasks:
  • TMG and ISAS Daily collection
    Daily collection of all the TMG and ISAS security events to the default repository and the default database.
  • TMG and ISAS Weekly Reporting
    Weekly reporting of TMG and ISAS Statistics and the most critical events.
• “All TMG and ISA servers” site