立即与支持人员聊天

Change Auditor Threat Detection 7.2 - Deployment Guide

Introduction to Change Auditor Threat Detection

Who should have input on the deployment plan? Components and workflow

Requirements and prerequisites Events to configure Port Requirements Maintaining the Change Auditor database size Deploying a Threat Detection server on ESX Deploying a Threat Detection server on Hyper-V

Hyper-V resource control settings

Upgrading the Threat Detection server

Upgrade from Change Auditor version 7.0.2

Update-CAThreatDetectionServer

Upgrade from Change Auditor version 7.0 and 7.0.1

Upload the update package to the Threat Detection server Upgrade the Threat Detection server Join the Threat Detection server to the coordinator's domain Configure the service account

Creating a Threat Detection configuration Reviewing configuration status

Configured server deployment details

Removing a configuration Historical events and your baseline calculations

Threat Detection configuration commands

Adding the PowerShell module Viewing available commands and help Threat Detection sample scripts Connecting to Change Auditor

Connect-CAClient

Managing a Threat Detection configuration

New-CAThreatDetectionConfiguration Get-CAThreatDetectionConfiguration Set-CAThreatDetectionConfiguration Remove-CAThreatDetectionConfiguration

Appendix: System Architecture

Threat Detection system overview

Threat Detection configuration commands

•

Adding the PowerShell module

•

Viewing available commands and help

•

Connecting to Change Auditor

•

Managing a Threat Detection configuration

Adding the PowerShell module

Change Auditor comes with a PowerShell module for you to use to manage your Threat Detection deployment. It is installed when you install the Windows client or a coordinator.


	NOTE: Windows PowerShell version 3.0 or higher is required.

To import the Change Auditor PowerShell module:

Open a Windows PowerShell window and type the following at the Windows PowerShell command prompt:

Import-Module <path>

Where "<path>" is the file path for the ChangeAuditor.PowerShell.dll assembly found in the Change Auditor Windows client or Change Auditor coordinator folder.

To ensure that the module was added, type the following at the Windows PowerShell command prompt:

Get-Module -All

The registered PowerShell modules are listed.

Viewing available commands and help

•

To view all available Change Auditor commands, enter:

Get-Command -Module ChangeAuditor.PowerShell

•

To view help on each command including the syntax, enter:

Get-Help cmdletName

•

To view an interactive command browser that shows you the layout of commands and the help for the commands, enter:

Show-Command cmdletName

Threat Detection sample scripts

Change Auditor includes the following sample scripts to help you configure and manage Threat Detection:

•

CreateThreatDetectionConfiguration.ps1

•

GetThreatDetectionConfiguration.ps1

•

ModifyThreatDetectionConfiguration.ps1

•

RemoveThreatDetectionConfiguration.ps1

•

UpdateThreatDetectionServer.ps1


	NOTE: By default they are located here: C:\Program Files\Quest\ChangeAuditor\Client\PowerShell Sample Scripts

请选择您的产品：

为向您提供更好的服务，请填写'Purpose of your Chat'（联系目的）：

针对您的问题建议的解决方案

Change Auditor Threat Detection 7.2 - Deployment Guide

Threat Detection configuration commands

Adding the PowerShell module

Viewing available commands and help

Threat Detection sample scripts