Change Auditor 7.5 - User Guide

Introduction to Change Auditor Threat Detection

Introduction to Change Auditor Threat Detection

To protect your data and your business, Change Auditor Threat Detection uses advanced machine learning, user and entity behavioral analytics (UEBA), and SMART correlation technology to spot anomalous activity and identify the highest risk users in your environment. The users with the highest risk scores are then highlighted in the Threat Detection dashboard, enabling you to prioritize your response and adjust policies to strengthen your organization’s security and regulatory enforcement.

For details about using the Threat Detection dashboard see the Change Auditor Threat Detection User Guide.

This guide gives information about how Change Auditor integrates with the Threat Detection server to process event data. It is intended for administrators who are responsible for the implementation, deployment, and monitoring of the Change Auditor Threat Detection deployment and configuration.

Who should have input on the deployment plan?

Who should have input on the deployment plan?

A complete deployment plan requires the combined effort of the resources within your organization who are responsible for information security, such as:

•	Chief Information Security Officers who understand the complexities of the enterprise’s IT infrastructure and are responsible for the overall handling of key vulnerabilities. Change Auditor provides data to help them deliver security updates and communications.

•	Security architects who are responsible for building and overseeing the implementation of the network’s security measures. They need to define the threat priorities for their environment.

•	Database and network administrators who are responsible for the implementation, deployment, and monitoring of the Change Auditor Threat Detection configuration.

•	Auditors and network administrators who are responsible for reviewing the potential threats, optimizing the system by inputting feedback, and prioritizing and investigate the most serious threats.

Components and workflow

Components and workflow

Change Auditor sends events in real time to the Threat Detection server to be used for analysis based on calculated user behavior baselines.

See the Change Auditor Threat Detection User Guide for details on Threat Detection concepts and terms.

To enable Threat Detection:

1

Apply the required licenses. (Change Auditor Threat Detection and any required Change Auditor auditing modules.) If you are using more than one coordinator, apply the license to all of them. To verify that a license is applied, right-click the coordinator icon in the system tray and select Licensing.

2	Configure required events for Threat Detection. See Events to configure.

3	Deploy the Threat Detection server on a virtual computer. See Deploying a Threat Detection server on ESX and Deploying a Threat Detection server on Hyper-V.

4	Configure Change Auditor to send collected event data to the Threat Detection server. See Creating a Threat Detection configuration.

5	Login to the Threat Detection dashboard to see the alerts and data. See the Threat Detection User Guide for information about navigating the dashboard and using the data to secure your environment.

Requirements and prerequisites

Requirements and prerequisites

For a successful deployment, ensure that your environment meets the minimum system requirements.

The Threat Detection server deployed on VMWare ESX is available in both 8 and 16 cores versions.
For a Hyper-v deployment, a single server is available and you select the number of cores during the deployment.

NOTE: The number of cores impact the length of time it takes to process historical audit data and build the baseline. 16 cores is recommended, 8 cores can be used if processing less than 5 million events per day.

Deployment on VMWare ESX

•	VMWare ESXI version 5.5 and above which is managed by VMware Vcenter 5.5 and above

•	The following vSphere clients are supported:

▪	With ESX 5.5 - vSphere Windows client.

▪	With ESX 6.0 - vSphere Flash client.

▪	With ESX 6.5 - vSphere Flex client, vSphere HTML5 client.

•	Small and medium sized enterprise edition OVA:

▪	OVA file size: ~10GB

▪	CPU: 8 cores, Minimal 2.3 GHz, Recommended 2.4 GHz

▪	RAM: 64 GB

▪	I/O: 500 MB/sec

▪	Disk: SAS 320 GB, SAS 930 GB

•	Large sized enterprise edition OVA:

▪	OVA file size: ~10GB

▪	CPU: 16 cores, Minimal 2.3 GHz, Recommended 2.4 GHz

▪	RAM: 64 GB

▪	I/O: 500 MB/sec

▪	Disk: SAS 320 GB, SAS 930 GB

Deployment on Microsoft Hyper-V

•	Hyper-V host which running on Windows server 2016

•	Threat Detection server requirements:

▪	Template size: ~10 GB

▪	CPU: 8 or 16 cores, Minimal 2.3 GHz, Recommended 2.4 GHz.

▪	RAM: 64 GB

▪	I/O: 500 MB/sec

▪	Disk: SAS 320 GB, SAS 930 GB.

For all deployments:

•	Obtain a static IP address for Threat Detection server and add DNS (A) record for it.

•	Determine the number of historical days to use for your activity baseline. For information on how to determine the best amount for you, see Historical events and your baseline calculations.