Change Auditor Threat Detection 7.1.1


	NOTE: Depending on the version of the ESXi, the deployment steps may be different. The below steps outline the process for vSphere Client version 6.5.

To deploy the Threat Detection server

Open vSphere client.


	NOTE: VMWare VSphere Client should be connected to VMWare vCenter not an individual ESXi host.

Select Actions | Deploy OVF Template.

Under Select template, choose Local file, browse for the OVA template, and click Next.

Under Select name and location, specify the name and inventory location for the deployed template and click Next.

On Select a resource, choose the destination computer for the OVA and click Next.

Under Review details, verify the OVF template details and click Next.

Under Select Storage, select the datastore for the configuration and the disk files and click Next. The Thin Provision option is recommended.

Under Select networks, choose a destination network for the virtual computer and select Next.

Under Customize template, enter the deployment properties for the Threat Detection sever.


Property	Description
Hostname	Fully qualified domain name of the Threat Detection server that has been registered in DNS. For example: hostname.yourcompany.com.
IP address	Static IPv4 address of the Threat Detection server.
Subnet mask	Subnet mask. For example: 255.255.255.0
Default gateway	Default gateway IP address.
DNS	DNS server IP address.
Integration password	Password required for the integration between Change Auditor and the Threat Detection server. The integration password is used during the Threat Detection configuration. The password must be 8-24 characters and can only include the following supported values: a-z, A-Z, 1-0, @,$. Maintain this password for use when creating the Threat Detection configuration.
Root password	Root password for the Threat Detection server. It must be 8-24 characters and can only include the following supported values: a-z, A-Z, 1-0, @,$.

Click Next.

Under Ready to complete, verify the information and click Finish.

Once the deployment in complete, power on the Threat Detection server.

Quest recommends that you take a snapshot of the newly deployed virtual server. This allows you to revert to a clean state without redeploying the server if you need to start over or re-create a configuration.

You are now ready to create a Threat Detection configuration in Change Auditor.

Deploying a Threat Detection server on Hyper-V

To optimize your server utilization and reduce costs, you can choose to deploy a virtual Threat Detection server using a Hyper-V virtual machine deployment.

The Threat Detection server, which is a a version of Red Hat Enterprise Linux 7 (64 bit), is available as .zip file that must be deployed on a Microsoft Hyper-V host environment by running a PowerShell script.

Begin by downloading the Change Auditor Hyper-V template (https://support.quest.com/change-auditor/download-new-releases) to the Hyper-V server.


	NOTE: PowerShell version 5 or higher is required.

To deploy the Threat Detection server

For remote deployments using an IP address to connect the Hyper-V server (in absence of a Hyper-V server DNS record), perform the following:

•

Start the Windows Remote Management (WS-Management) /(WinRM) service.

•

Run this PowerShell command as an administrator to add the Hyper-V server IP address to the TrustedHosts list:

set-item wsman:\localhost\Client\TrustedHosts -value <Your_Hyper-V_Host_IP_Address>

From the Change Auditor client browse to the DeployThreatDetectionHyper-VServer.ps1 deployment script. By default it is located here: C:\Program Files\Quest\ChangeAuditor\Client\PowerShell Sample Scripts.


	NOTE: You can run the script on the same computer as where you are deploying the Threat Detection server (local deployment) or from any other computer in the network (remote deployment).

Right-click the deployment script and select Run with PowerShell.

Enter the deployment properties for the Threat Detection sever.


Property	Description
Hostname or IP address	The hostname or IP address of the Hyper-V server.
Hyper-V administrator	The account used to deploy the Threat Detection server. The user specified must be a Hyper-V administrator.
Hyper-V password	Password for the Hyper-V administrator.
Threat Detection Hyper-V template location	Location of the Threat Detection Hyper-V template zip file on the Hyper-V server.
Folder for the virtual machine HD files	The path of the folder where the Threat Detection server's hard disk files will be installed on the Hyper-V server during deployment. If the folder does not exist, it will be created.
Folder for the virtual machine configuration files	The path of the folder where the Threat Detection server’s configuration files will be installed on the Hyper-V server during deployment. If the folder does not exist, it will be created.
Virtual machine name	The name of the Threat Detection server in the Hyper-V management console.
Number of virtual machine cores	The number of machine cores (8 or 16). NOTE: 16 cores is recommended, 8 cores can be used if processing less than 5 million events per day.
Network adapter	The script returns the list of available network adapters for the Threat Detection server. Select one from the list.
VLAN identifier	The virtual local area network (VLAN) identifier which is a number between 1 and 4094. (This is only required if your network uses a VLAN.)
Hostname	Fully qualified domain name of the Threat Detection server registered in DNS. For example: hostname.yourcompany.com
IP address	Static IPv4 address of the Threat Detection server.
Subnet mask	Subnet mask for the Threat Detection server. For example: 255.255.255.0
Default gateway	IP address of the default gateway for the Threat Detection server.
DNS	DNS server IP for the Threat Detection server.
Integration Password	Password required for the integration between Change Auditor and the Threat Detection server. The integration password is used during the Threat Detection configuration. The password must be 8-24 characters and can only include the following supported values: a-z, A-Z, 1-0, @,$. Maintain this password for use when creating the Threat Detection configuration.
Root Password	The root password. It must be 8-24 characters and can only include the following supported values: a-z, A-Z, 1-0, @,$.

Review and confirm the Threat Detection server settings. To continue enter Yes. To change the properties, enter No.

The Hyper-V Threat Detection server will now be deployed. This may take several minutes.

If you are using System Center Virtual Machine Manager (SCVMM) to manage your Hyper-V hosts, refresh the Virtual Machine Manager (VMM) dashboard to display the Threat Detection server.

Open the Virtual Machine Manager (VMM) dashboard. Under VMs and Services, select All Hosts.

Right-click the Hyper-V host where the Threat Detection server is hosted and click Refresh Virtual Machines.

Quest recommends that you take a checkpoint of the newly deployed virtual server. This allows you to revert to a clean state without redeploying the server if you need to start over or re-create a configuration.

You are now ready to create a Threat Detection configuration in Change Auditor. See Creating a Threat Detection configuration.


	NOTE: The Threat Detection server uses Dynamic MAC address for its network adapter. If you are using SCVMM to manage your Hyper-V hosts and you plan to move the Threat Detection server from one Hyper-V server to another, ensure that after moving, the server is allocated an unused MAC address or alternatively change the address to a static MAC address.

Hyper-V resource control settings

After you have deployed the Threat Detection server, you can select to adjust the Hyper-V processor settings to reserve an amount of processor capacity for a specific virtual machine or, alternatively, configure which virtual machine is given priority in your environment.

Change Auditor’s deployment of a Threat Detection server uses the system defaults unless otherwise specified.
To change the values for these properties, open the virtual machine’s setting, select the Processor, and configure the associated resource control setting.

Table 3. Hyper-V CPU settings


Property	Description	Best Practice
Reserve	The percentage of logical processor resources that are reserved for the Threat Detection server. For example, if the host machine has 8 logical CPUs, then setting this value to 25% would reserve 2 of those CPUs for the Threat Detection server. The default value is dynamic based on the CPU.	Set this value to 100% to ensure the Threat Detection server will have access to the resources that it requires.
Relative Weight	Determines how the CPU is distributed when you want to set which virtual machine takes priority when there is contention for the processor. For example, a virtual machine with a relative weight of 200, receives twice as much processor time than one set to 100. The default value for all virtual machines is 100.	The weight ranges from 1-10000. To give the Threat Detection server priority, assign it with a higher weight than all other computers in your environment.