InTrust 11.5.1 - System Requirements

Microsoft Forefront Threat Management Gateway and ISA Server Events

Server side:

• InTrust Server
• Microsoft Microsoft TMG Management Console for data gathering without agents

Processed computer:

Rights and permissions for data gathering with agents:

The following rights and permissions must be assigned to the InTrust agent account if the agent is not running under the LocalSystem account:

• Read permission to the server (or server array) configuration
• Read permission to the HKLM\SYSTEM\CurrentControlSet\Control\TimeZoneInformation registry key
• Read and List Folder Contents permissions to log file folders; the Delete permission must also be granted if the Clear log after gathering option is turned on for the data source

Requirements for gathering Threat Management Gateway logs in SQL Server Express format without agents:

• RPC connections to the Threat Management Gateway server must be allowed.
• The SQL Server instance named "MSFW" on the Threat Management Gateway server must be made remotely available.
• The Microsoft TMG Management Console must be installed on the InTrust server.

Microsoft DHCP Server Events

Server side:

• InTrust Server

Processed computer:

Rights and permissions for data gathering without agents:

• Access this computer from the network right
• Deny access to this computer from network right must be disabled
• Read permission to the HKLM\SYSTEM\CurrentControlSet\Services\DHCPServer\Parameters registry key
• Read permission to the HKLM\SYSTEM\CurrentControlSet\Control\TimeZoneInformation registry key
• Read permission to the HKLM\SYSTEM\CurrentControlSet\Control\Nls\Language registry key
• Membership in the local Administrators group
• Read and List Folder Contents permissions to log file folders; the Delete permission must also be granted if the Clear log after gathering option is turned on for the data source

Rights and permissions for data gathering with agents:

• Read permission to the HKLM\SYSTEM\CurrentControlSet\Services\DHCPServer\Parameters registry key
• Read permission to the SYSTEM\CurrentControlSet\Control\TimeZoneInformation registry key
• Read and List Folder Contents permissions to log file folders; the Delete permission must also be granted if the Clear log after gathering option is turned on for the data source

Exchange

• Microsoft Windows Events
• Microsoft IIS Events
• Microsoft Forefront Threat Management Gateway and ISA Server Events
• Microsoft DHCP Server Events
• Exchange Server
• Red Hat Enterprise Linux Events
• Oracle Linux Events
• SUSE Linux Events
• Debian GNU/Linux Events
• Ubuntu Linux Events
• IBM AIX Events
• VMware vCenter Events
• VMware ESX and ESXi Events

Red Hat Enterprise Linux Events

Server side:

• InTrust Server

Processed computer: