Change Auditor Threat Detection 7.0.2


	NOTE: You can run the script on the same computer as where you are deploying the Threat Detection server (local deployment) or from any other computer in the network (remote deployment).

Right-click the deployment script and select Run with PowerShell.

Enter the deployment properties for the Threat Detection sever.


Property	Description
Hostname or IP address	The hostname or IP address of the Hyper-V server.
Hyper-V administrator	The account used to deploy the Threat Detection server. The user specified must be a Hyper-V administrator.
Hyper-V password	Password for the Hyper-V administrator.
Threat Detection Hyper-V template location	Location of the Threat Detection Hyper-V template zip file on the Hyper-V server.
Folder for the virtual machine HD files	The path of the folder where the Threat Detection server's hard disk files will be installed on the Hyper-V server during deployment. If the folder does not exist, it will be created.
Folder for the virtual machine configuration files	The path of the folder where the Threat Detection server’s configuration files will be installed on the Hyper-V server during deployment. If the folder does not exist, it will be created.
Virtual machine name	The name of the Threat Detection server in the Hyper-V management console.
Number of virtual machine cores	The number of machine cores (8 or 16). NOTE: 16 cores is recommended, 8 cores can be used if processing less than 5 million events per day.
Network adapter	The script returns the list of available network adapters for the Threat Detection server. Select one from the list.
Hostname	Fully qualified domain name of the Threat Detection server registered in DNS. For example: hostname.yourcompany.com
IP address	Static IPv4 address of the Threat Detection server.
Subnet mask	Subnet mask for the Threat Detection server. For example: 255.255.255.0
Default gateway	IP address of the default gateway for the Threat Detection server.
DNS	DNS server IP for the Threat Detection server.
Integration Password	Password required for the integration between Change Auditor and the Threat Detection server. The integration password is used during the Threat Detection configuration. The password must be 8-24 characters and can only include the following supported values: a-z, A-Z, 1-0, @,$. Maintain this password for use when creating the Threat Detection configuration.
Root Password	The root password. It must be 8-24 characters and can only include the following supported values: a-z, A-Z, 1-0, @,$.

Review and confirm the Threat Detection server settings. To continue enter Yes. To change the properties, enter No.

The Hyper-V Threat Detection server will now be deployed. This may take several minutes.

If you are using System Center Virtual Machine Manager (SCVMM) to manage your Hyper-V hosts, refresh the Virtual Machine Manager (VMM) dashboard to display the Threat Detection server.

Open the Virtual Machine Manager (VMM) dashboard. Under VMs and Services, select All Hosts.

Right-click the Hyper-V host where the Threat Detection server is hosted and click Refresh Virtual Machines.

Quest recommends that you take a checkpoint of the newly deployed virtual server. This allows you to revert to a clean state without redeploying the server if you need to start over or re-create a configuration.

You are now ready to create a Threat Detection configuration in Change Auditor. See Creating a Threat Detection configuration.


	NOTE: The Threat Detection server uses Dynamic MAC address for its network adapter. If you are using SCVMM to manage your Hyper-V hosts and you plan to move the Threat Detection server from one Hyper-V server to another, ensure that after moving, the server is allocated an unused MAC address or alternatively change the address to a static MAC address.

Hyper-V resource control settings

After you have deployed the Threat Detection server, you can select to adjust the Hyper-V processor settings to reserve an amount of processor capacity for a specific virtual machine or, alternatively, configure which virtual machine is given priority in your environment.

Change Auditor’s deployment of a Threat Detection server uses the system defaults unless otherwise specified.
To change the values for these properties, open the virtual machine’s setting, select the Processor, and configure the associated resource control setting.

Table 2. Hyper-V CPU settings


Property	Description	Best Practice
Reserve	The percentage of logical processor resources that are reserved for the Threat Detection server. For example, if the host machine has 8 logical CPUs, then setting this value to 25% would reserve 2 of those CPUs for the Threat Detection server. The default value is dynamic based on the CPU.	Set this value to 100% to ensure the Threat Detection server will have access to the resources that it requires.
Relative Weight	Determines how the CPU is distributed when you want to set which virtual machine takes priority when there is contention for the processor. For example, a virtual machine with a relative weight of 200, receives twice as much processor time than one set to 100. The default value for all virtual machines is 100.	The weight ranges from 1-10000. To give the Threat Detection server priority, assign it with a higher weight than all other computers in your environment.

Upgrading the Threat Detection server

For the Threat Detection system to function properly, the Threat Detection server must be compatible with the installed version of Change Auditor. To see if your Threat Detection server is compatible or if an upgrade is required see Reviewing configuration status.

You can upgrade your existing Threat Detection server by running an update script and a series of configuration commands on the Threat Detection server. This will ensure that your existing configuration and Threat Detection information is maintained.

To upgrade the Threat Detection server:

•

Download the update package (UpdateTDServer-<Change Auditor version>.zip) from https://support.quest.com/change-auditor/download-new-releases.

•

Log on to the Threat Detection server and upload the update package to the server. For details see, Upload the update package the Threat Detection server.

•

Upgrade the Threat Detection server by running the update script. For details see, Upgrade the Threat Detection server.

•

Join the Threat Detection server to the coordinator’s domain to enable single sign-on capability to the Threat Detection dashboard. For details see, Join the Threat Detection server to the coordinator’s domain.

•

Configure a service account that is used by the Treat Detection server for communicating with Active Directory to verify single-sign on user access to the dashboard. For details see, Configure the service account.


	IMPORTANT: Quest recommends that you take a snapshot (for ESX deployments) and a checkpoint (for Hyper-v deployments) of the Threat Detection server before beginning the upgrade process. This allows you to revert to the initial state. For details see the vSphere documentation and the Microsoft documentation.

Upload the update package the Threat Detection server

To upload the update package the Threat Detection server

Log on to the Threat Detection server through your preferred SFTP client with the username ‘presidio’ and the integration password specified during the Threat Detection server configuration.


	NOTE: Ensure your SFTP client transfer setting is set to Binary before uploading the zip package.

Upload the UpdateTDServer-<Change Auditor version>.zip file to the ‘/home/presidio’ directory.

请选择您的产品：

为向您提供更好的服务，请填写'Purpose of your Chat'（联系目的）：

针对您的问题建议的解决方案

Change Auditor Threat Detection 7.0.2 - Deployment Guide

Deploying a Threat Detection server on Hyper-V

Hyper-V resource control settings

Upgrading the Threat Detection server

Upload the update package the Threat Detection server