Chat now with support

Get Live Help
Complete Registration

Sign In

Request Pricing

Contact Sales

Change Auditor Threat Detection 7.0.4 - Deployment Guide

Table of Contents

Deploying Threat Detection

Introduction to Change Auditor Threat Detection

Who should have input on the deployment plan? Components and workflow

Requirements and prerequisites Events to configure Port Requirements Maintaining the Change Auditor database size Deploying a Threat Detection server on ESX Deploying a Threat Detection server on Hyper-V

Hyper-V resource control settings

Upgrading the Threat Detection server

Upgrade from Change Auditor version 7.0.2

Update-CAThreatDetectionServer

Upgrade from Change Auditor version 7.0 and 7.0.1

Upload the update package to the Threat Detection server Upgrade the Threat Detection server Join the Threat Detection server to the coordinator's domain Configure the service account

Creating a Threat Detection configuration Reviewing configuration status

Configured server deployment details

Removing a configuration Historical events and your baseline calculations

Threat Detection configuration commands

Adding the PowerShell module Viewing available commands and help Threat Detection sample scripts Connecting to Change Auditor

Connect-CAClient

Managing a Threat Detection configuration

New-CAThreatDetectionConfiguration Get-CAThreatDetectionConfiguration Set-CAThreatDetectionConfiguration Remove-CAThreatDetectionConfiguration

Appendix: System Architecture

Threat Detection system overview

Threat Detection system overview

The integration process to analyze events includes the following:

1

Change Auditor agents collect events from various systems and the coordinator writes the events into the database.

2

Users create a Threat Detection configuration using the Change Auditor client.

3

As part of the configuration, the coordinator creates the webhook subscription to send events to the Threat Detection server. The subscription contains information such as where to send events (the URL of the webhook receiver in the Threat Detection server), which events to include, and the coordinator responsible for event forwarding.

4

The designated coordinator continually queries events from the Change Auditor database and sends them to the webhook receiver in the Threat Detection server.

5

Threat Detection server performs event modeling and scoring.

6

Threat indicators, alerts, and risky users are displayed in the Threat Detection dashboard.

Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating

© ALL RIGHTS RESERVED. Feedback Terms of Use Privacy Cookie Preference Center