Change Auditor 7.5 - User Guide

Events to configure

Events to configure

NOTE: Consider Maintaining the Change Auditor database size when adding events for Threat Detection auditing.

Events from the following modules are used to build models and generate alerts:

Table 1. Events used for modeling and alerts

Module	Events
Change Auditor for Logon Activity	Authentication Activity events – these are the successful and failed interactive and remote interactive events (all enabled by default). Domain Controller Authentication events – Ensure that you enable the ‘User authenticated through Kerberos” event. By default, it is disabled.
Change Auditor for Active Directory	User and group events (all enabled by default).
Change Auditor for Windows File Servers Change Auditor for EMC Change Auditor for NetApp	For optimal Threat Detection results, Quest recommends that you select file, folder, and share events that audit permission changes, create, delete, rename, and open actions during the template creation.

Port Requirements

Port Requirements

The following ports are required for Threat Detection server operation:

Table 2. Port requirements

Component	Ports
Coordinator to Threat Detection server	• SSH TCP 22 - Facilitates Threat Detection server upgrades and maintenance. • HTTPS TCP 443 - Creation, removal, and operation of Threat Detection subscription.
Change Auditor client and Chrome web browser to Threat Detection server	• HTTPS TCP 443 - Threat Detection dashboard and interface.
Threat Detection server to Active Directory	• LDAP TCP/UDP 389 - Active Directory services. • Global Catalog (GC) TCP 3268 - Active Directory services. • DNS UDP 53 - Name resolution. • Kerberos TCP 88 - Kerberos authenticated connections.

Maintaining the Change Auditor database size

Maintaining the Change Auditor database size

Some of the events required for Threat Detection can be very noisy and take up significant space in the Change Auditor database. Once the events are sent to the Threat Detection server for analysis storage in the Change Auditor database is no longer needed.

To ensure the database maintains a manageable size, Quest recommends that you purge events older than 30 days.

Particularly noisy events are:

•	User authenticated through Kerberos

•	File and folder open

Deploying a Threat Detection server on ESX

Deploying a Threat Detection server on ESX

To download the Threat Detection server go to https://support.quest.com/change-auditor/7.0.3/download-new-releases.

The Threat Detection server, which is a version of Red Hat Enterprise Linux 7 (64 bit), is available as Open Virtual Appliance (OVA) file that must be deployed on VMWare ESXi using VMWare VSphere Client.

NOTE: Depending on the version of the ESXi, the deployment steps may be different. The below steps outline the process for vSphere Client version 6.5.

To deploy the Threat Detection server

1	Open vSphere client.

NOTE: VMWare VSphere Client should be connected to VMWare vCenter not an individual ESXi host.

2	Select Actions | Deploy OVF Template.

3	Under Select template, choose Local file, browse for the OVA template, and click Next.

4	Under Select name and location, specify the name and inventory location for the deployed template and click Next.

5	On Select a resource, choose the destination computer for the OVA and click Next.

6	Under Review details, verify the OVF template details and click Next.

7	Under Select Storage, select the datastore for the configuration and the disk files and click Next. The Thin Provision option is recommended.

8	Under Select networks, choose a destination network for the virtual computer and select Next.

9	Under Customize template, enter the deployment properties for the Threat Detection sever.

Property	Description
Hostname	Fully qualified domain name of the Threat Detection server that has been registered in DNS. For example: hostname.yourcompany.com.
IP address	Static IPv4 address of the Threat Detection server.
Subnet mask	Subnet mask. For example: 255.255.255.0
Default gateway	Default gateway IP address.
DNS	DNS server IP address.
Integration password	Password required for the integration between Change Auditor and the Threat Detection server. The integration password is used during the Threat Detection configuration. The password must be 8-24 characters and can only include the following supported values: a-z, A-Z, 1-0, @,$. Maintain this password for use when creating the Threat Detection configuration.
Root password	Root password for the Threat Detection server. It must be 8-24 characters and can only include the following supported values: a-z, A-Z, 1-0, @,$.

10	Click Next.

11	Under Ready to complete, verify the information and click Finish.

12	Once the deployment in complete, power on the Threat Detection server.

Quest recommends that you take a snapshot of the newly deployed virtual server. This allows you to revert to a clean state without redeploying the server if you need to start over or re-create a configuration.

You are now ready to create a Threat Detection configuration in Change Auditor.