Chat now with support
Chat with Support

Change Auditor Threat Detection 7.1.1 - Deployment Guide

Upgrade the Threat Detection server

To upgrade the server:
1
Log on to the Threat Detection server with the username ‘presidio’ and the integration password specified during the Threat Detection server configuration.
2
Run ‘cd /home/presidio/’ to change the directory to the presidio home directory.
3
Run 'unzip UpdateTDServer-7.0.3.11471.zip' to unzip the update package.
4
Run ‘cd /home/presidio/UpdateTDServer-7.0.3.11471’ to change to the unzipped directory.
5
Run ‘./update.sh’ to run the upgrade script.
6
When prompted, enter the integration password.
The server will now be upgraded; this could take up to 15 minutes to complete.
A log file detailing the results of the update is generated after the update is complete. The log file is located here: /home/presidio/update logs and is called UpdateTDServer-YYYY-MM-DD.log. (Where the date is the date of the update.).

Join the Threat Detection server to the coordinator's domain

Join the Threat Detection server to the coordinator’s domain
To join the server to the coordinator’s domain:
1
While logged on to the Threat Detection server, open a command prompt.
2
Run ‘cd /opt/quest/bin’ to change the directory to the Quest tools directory.
3
Run 'sudo ./vastool -u < User SamAccountName> join <domain FQDN>' to join the server to the coordinator’s domain.
* 
NOTE: The user must be a domain administrator or have been delegated the following tasks using the Active Directory Delegation Control wizard:
•
Create, delete, and manage user account.
•
Join a computer to the domain.
4
When prompted for the “Password for presidio”, enter the integration password.
5
When prompted for the password for the domain, enter the password of the user account specified in step 3.
The Threat Detection server will now be joined to the domain.
6
Run './vastool info domain’ to verify that the server is joined to the domain. The command will return the domain for the Threat Detection server.

Configure the service account

To configure the service account:
1
While logged on to the Threat Detection server with the username ‘presidio’ and the integration password specified during the Threat Detection server configuration open a command prompt.
2
Run ‘cd /opt/quest/sbin’ to change the directory to the Quest sbin tools directory.
3
Run ‘sudo ./setup-mod_auth_vas4’ to create the service account.
You will now be prompted with a series of questions, accept the default answers for the prompts.
4
When prompted for a sufficiently privileged domain account, enter the domain administrator account (SAMAccountName).
5
Accept the default answer to change group of /etc/opt/quest/vas/HTTP.keytab to Apache.
6
Specify any SPN aliases (if required) or Enter to finish.
7
Run ‘sudo service httpd restart’ to restart the httpd service to finish the configuration.
The service account will now be created in Active Directory.
8
Verify that the service account has been created in the Computers container in the same domain as the Threat Detection server. The service account will be a user account with the same name as the Threat Detection server with “HTTP” appended to it.

Creating a Threat Detection configuration

A Threat Detection configuration must be created to view activity, receive alerts, and analyze anomalies on the dashboard.

When a configuration is created, the Threat Detection server is automatically joined to your coordinator's domain and an associated service account is created. This is required to enable single-sign on to the Threat Detection dashboard.

To create a Threat Detection configuration
1
From Change Auditor select Administration Tasks | Configuration | Threat Detection.
2
Enter the Threat Detection server fully qualified domain name and integration password you created when deploying the Threat Detection server.
3
Enter the account used to join the Threat Detection server to your coordinator’s domain. (Use this format for the account: <Domain>\<User Name>.)
* 
NOTE: The user must be a domain administrator or have been delegated the following tasks using the Active Directory Delegation Control wizard:
•
Create, delete, and manage user account.
•
Join a computer to the domain.
4
Select how many days of historical events should be sent to Threat Detection server. For information on how to determine the best amount for you, see Historical events and your baseline calculations.
5
Select Apply Changes.
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating