Chat now with support
Chat with Support

Change Auditor Threat Detection 7.1.1 - Deployment Guide

Get-CAThreatDetectionConfiguration

Use this command to view the Threat Detection configuration information and information about the associated subscription.

Table 3. Available parameters
Parameter
Description

-Connection

A connection obtained by using the Connect-CAClient command. See Connecting to Change Auditor.

Example: Review Threat Detection configuration details

Get-CAThreatDetectionConfiguration -Connection $connection

Command output

The command returns the following information. For more information about some of these settings see the Change Auditor SIEM Integration Guide.

Table 4. Available configuration information
Setting
Description

TDServer

The Threat Detection server fully qualified domain name.

ConfigurationState

State of the configuration:

•
Configured: Threat Detection has been configured
•
Unconfigured: Threat Detection has not been configured
•
A valid Change Auditor Threat Detection license is required

HistoricalDays

How many days of historical events have been sent to Threat Detection server.

TDServerStatus

Status of the Threat Detection server:

•
Online
•
Offline

DataProcessingStatus

Status of the data processing. For example, building baseline.

TDServerVersion

Threat Detection server version.

TDSubscriptionId

Threat Detection subscription ID.

StartTime

Starting point in time for events to send.

Subsystems

Subsystems that have been selected for event sending.

TDSubscriptionEnabled

Whether the Threat Detection subscription is enabled.

NotificationInterval

How often how often (in milliseconds) events are sent.

HeartbeatInterval

Interval (in milliseconds) that a heartbeat check is made for the configuration.

BatchSize

Batch size. The maximum number of events to include in a single notification message.

NotificationUrl

Url for notifications.

HeartbeatUrl

Url for heartbeat notifications.

LastEventTime

When the last event was sent.

LastEventResponse

Last event response (For example OK, HTTP 429 - Too many events being sent, and HTTP 401 - Unauthorized access.)

LastHeartbeatTime

When the last heartbeat was sent.

LastHeartbeatResponse

The last heartbeat response. (For example OK, HTTP 429 - Too many events being sent, and HTTP 401 - Unauthorized access.)

EventsSent

Number of events sent.

BatchesSent

Number of batches sent.

HeartbeatsSent

Number of heartbeats sent.

BookmarkTime

Time the last event was sent.

AllowedCoordinators

List of coordinators permitted to send events.

LastCoordinator

The coordinator that is sending events. If the subscription is disabled, this is the last coordinator that sent events.

Set-CAThreatDetectionConfiguration

Use this command to modify the list of allowed coordinators for the Threat Detection configuration.

Table 5. Available parameters
Parameter
Description

-Connection

A connection obtained by using the Connect-CAClient command. See Connecting to Change Auditor.

-AllowedCoordinators (Optional)

The DNS or NetBIOS name of the coordinators permitted to send events. If none are specified, all coordinators installed at the time of configuration are permitted to send events.

NOTE: The list order does not determine which coordinator is selected to send events.

Example: Modifying a configuration

Set-CAThreatDetectionConfiguration -Connection $connection -AllowedCoordinators @('machine1.domain.com','machine2.domain.com')

Example: To clear a previous list of allowed coordinators

Set-CAThreatDetectionConfiguration -Connection $connection -AllowedCoordinators @()

Remove-CAThreatDetectionConfiguration

Use this command to remove a Threat Detection configuration.

* 
NOTE:  

Deleting the configuration only removes configuration information from Change Auditor. It does not remove data or configuration on the Threat Detection server.

•
If you are removing the configuration as a part of a clean up process, you can delete the Threat Detection server after removing configuration.
•
If you are removing the configuration and plan to start over, you can either revert to a snapshot from a previously deployed (but not configured) Threat Detection server or deploy a new Threat Detection server.
•
When you join the server to the domain during configuration, Change Auditor creates a computer and service account in the domain required for Integrated Windows Authentication. The computer and service account must be removed from the domain when a configuration is removed.
Table 6. Available parameters
Parameter
Description

-Connection

A connection obtained by using the Connect-CAClient command. See Connecting to Change Auditor.

Example: Remove the Threat Detection configuration

Remove-CAThreatDetectionConfiguration -Connection $connection

Appendix: System Architecture

•
Threat Detection system overview
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating