diff --git a/docs/threatprevention/7.5/admin/agents/agents-windows/enrollmentsecretconfiguration.md b/docs/threatprevention/7.5/admin/agents/agents-windows/enrollmentsecretconfiguration.md index b21a439f21..b66fbf07ce 100644 --- a/docs/threatprevention/7.5/admin/agents/agents-windows/enrollmentsecretconfiguration.md +++ b/docs/threatprevention/7.5/admin/agents/agents-windows/enrollmentsecretconfiguration.md @@ -15,16 +15,16 @@ enrollment secret is applied depends on the method used to install the Agent. and use a new enrollment secret as part of automated Agent installation. - If installing the Agent manually, the enrollment secret must be entered in the Certificates window of the Agent Setup wizard during installation. See the - [Manual Agent Deployment](/docs/threatprevention/7.5/install/agent/manual/manual.md) topic for additional information. + [Manual Agent Deployment](/docs/threatprevention/7.5/install/agent/manual.md) topic for additional information. -Follow the steps to generate the enrollment secret. +To generate the enrollment secret, complete the following steps: **Step 1 –** Click **Agents** in the left pane to launch the Agents interface. Then click **Agent Enrollment Secret** to launch the Enrollment Secret Configuration window. ![Enrollment Secret Configuration window](/images/threatprevention/7.5/admin/agents/window/enrollmentsecret.webp) -The Enrollment Secret Configuration window enables you to generate the enrollment secret required to +Use the Enrollment Secret Configuration window to generate the enrollment secret required to manually deploy the Agent. It has the following fields: - Enrollment Secret – A limited-life (1 hour) password generated by the Enterprise Manager. The diff --git a/docs/threatprevention/7.5/admin/agents/deploy/overview.md b/docs/threatprevention/7.5/admin/agents/deploy/overview.md index 0144eb9032..4eec4e8479 100644 --- a/docs/threatprevention/7.5/admin/agents/deploy/overview.md +++ b/docs/threatprevention/7.5/admin/agents/deploy/overview.md @@ -8,7 +8,7 @@ sidebar_position: 20 The Threat Prevention Agent can be deployed through any of the following methods: -- Deploy the Agent to server(s) through the Administration Console – You can deploy the Agent to one +- Deploy the Agent to servers through the Administration Console – You can deploy the Agent to one or multiple servers through the Administration Console :::info @@ -18,30 +18,30 @@ The Threat Prevention Agent can be deployed through any of the following methods - Manually through the Windows Agent Setup Wizard – Run the Agent executable to launch this wizard -See the [Manual Agent Deployment](/docs/threatprevention/7.5/install/agent/manual/manual.md) topic for additional +See the [Manual Agent Deployment](/docs/threatprevention/7.5/install/agent/manual.md) topic for additional information. ## Deploy Agents Wizard -The Deploy Agents wizard enables you to deploy Agents from the Administration Console. Computers +Use the Deploy Agents wizard to deploy Agents from the Administration Console. Computers targeted for Agent deployment must meet the minimum .NET Framework version required by the Agent or the deployment fails. Remember to check server requirements before deploying the Agent, including compatibility with other security products. See the [Agent Server Requirements](/docs/threatprevention/7.5/requirements/agent/agent.md) topic for additional information. :::note -The wizard does not block access to the Administration Console and can be minimized while +The wizard doesn't block access to the Administration Console and can be minimized while actions are in progress. If this wizard is hidden by clicking outside of the dialog box, a flashing blue link displays on the upper right corner of the interface with the action name displayed. Click -this link to bring back the focus to the wizard. +the flashing blue link to bring back the focus to the wizard. ::: The Deploy Agents wizard consists of four windows: Select Computers, Set Options, Prerequisites Check, and Installing. -Follow the steps to deploy the Agent from the Administration Console to a new or existing machine -using the Deploy Agents wizard. +To deploy the Agent from the Administration Console to a new or existing machine +using the Deploy Agents wizard, complete the following steps: :::warning Closing the Administration Console while this action is in process causes problems with @@ -63,13 +63,13 @@ tabs on the window. See the [Select Computers Window](/docs/threatprevention/7.5 information. Click **Next**. If you open this window through the [Right-Click Menu](/docs/threatprevention/7.5/admin/agents/overview.md#right-click-menu) action, the -list is auto-populated with the computer(s) selected on the Agents interface. +list is auto-populated with the computers selected on the Agents interface. ![Deploy Agents wizard – Set Options page](/images/threatprevention/7.5/admin/agents/deploy/setoptions.webp) **Step 4 –** On the Set Options window, enter the credentials required to deploy the Agent on the -selected machine(s). Review the Enterprise Manager IP address/name and port for accuracy and select -the desired modules to install for this Agent. You can also set other properties for the Agent. See +selected machines. Review the Enterprise Manager IP address/name and port for accuracy and select +the modules you want to install for this Agent. You can also set other properties for the Agent. See the [Set Options Window ](/docs/threatprevention/7.5/admin/agents/deploy/setoptions.md)topic for additional information. **Step 5 –** Once configurations are set, click **Next**. @@ -83,16 +83,16 @@ for additional information. ![Deploy Agents wizard – Installing page](/images/threatprevention/7.5/admin/agents/deploy/installing.webp) -**Step 7 –** The Installing window performs the installation and displays whether or not the action +**Step 7 –** The Installing window performs the installation and displays whether the action was successful. See the [Installing Window ](/docs/threatprevention/7.5/admin/agents/deploy/installing.md) topic for additional information. **Step 8 –** When the task is successfully completed, click **Finish** to close the window. -The Agent will be listed in the table on the Agents interface. +The Agent appears in the table on the Agents interface. :::note If the server where the Agent is deployed has multiple network adapters (multi-homed), -then it is necessary to bind the Agent to an adapter that can communicate with the Enterprise +then you must bind the Agent to an adapter that can communicate with the Enterprise Manager. See the [Bind To](/docs/threatprevention/7.5/troubleshooting/agentcommunication.md#bind-to) topic for additional information. ::: @@ -100,7 +100,7 @@ additional information. ## Update Agent Settings -Follow the steps to update the settings for a deployed Agent through the Agents interface. +To update the settings for a deployed Agent through the Agents interface, complete the following steps: **Step 1 –** Click Agents in the left pane to launch the Agents interface. @@ -113,7 +113,7 @@ automatically added to the Update Agent settings on These Computers box. See the **Step 4 –** On the Set Options window, ensure the proper credentials, modules, and Enterprise Manager location are accurate alongside additional options. To make changes to the settings, uncheck -the **Keep Existing Settings** box. Make necessary updates as needed. See the +the **Keep Existing Settings** box. Make the necessary updates. See the [Set Options Window ](/docs/threatprevention/7.5/admin/agents/deploy/setoptions.md) topic for additional information. **Step 5 –** On the Prerequisites Check window, the credentials provided on the Set Options window @@ -125,7 +125,7 @@ either succeed or fail during a prerequisites or verification check. See the status messages display: - Failed – Read the failure message and either click **Back** to provide new credentials or click - **Finish** to close the window and ensure any error messages are taken care of prior to next + **Finish** to close the window and resolve any error messages before the next attempt - Completed – Indicates that the Agent has been successfully updated diff --git a/docs/threatprevention/7.5/admin/agents/overview.md b/docs/threatprevention/7.5/admin/agents/overview.md index b2642035e7..ca6dc7f340 100644 --- a/docs/threatprevention/7.5/admin/agents/overview.md +++ b/docs/threatprevention/7.5/admin/agents/overview.md @@ -6,14 +6,14 @@ sidebar_position: 40 # Agents Interface -The Agents interface allows you to quickly view, deploy, and manage Agents from a centralized +Use the Agents interface to quickly view, deploy, and manage Agents from a centralized location to the targeted domain controllers in a domain. The Agent must be deployed on all domain -controllers that you want to receive event data for. Once one or more Agent(s) are deployed to a +controllers that you want to receive event data for. Once one or more Agents are deployed to a domain, it becomes known as a targeted domain. The Threat Prevention Agent can be deployed through any of the following methods: -- Deploy the Agent to server(s) through the Administration Console – You can deploy the Agent to one +- Deploy the Agent to servers through the Administration Console – You can deploy the Agent to one or multiple servers through the Administration Console :::info @@ -24,7 +24,7 @@ The Threat Prevention Agent can be deployed through any of the following methods - Manually through the Windows Agent Setup Wizard – Run the Agent executable to launch this wizard See the [Deploy Agents](/docs/threatprevention/7.5/admin/agents/deploy/overview.md) and -[Manual Agent Deployment](/docs/threatprevention/7.5/install/agent/manual/manual.md) topics for additional information. +[Manual Agent Deployment](/docs/threatprevention/7.5/install/agent/manual.md) topics for additional information. Click **Agents** in the left pane to open the Agents interface. @@ -48,7 +48,7 @@ information for an Agent: ![Warning Symbol for an Agent](/images/threatprevention/7.5/admin/agents/warningsymbol.webp) - - AD Event Latency – Time difference between when the event was detected by the Agent and when + - AD Event Latency – Time difference between when the Agent detected the event and when the Enterprise Manager received it :::note @@ -61,7 +61,7 @@ information for an Agent: ::: -- FSMO Roles – The FSMO (Flexible Single Master Operation) role(s) currently assigned to the domain +- FSMO Roles – The FSMO (Flexible Single Master Operation) roles assigned to the domain controller where the Agent is deployed. Role names are displayed as abbreviations. For example, 'SM' is displayed for the Schema Master role. Hover over data in this column to view the full names. @@ -86,10 +86,10 @@ information for an Agent: - Active (Modules Pending) – The Agent is active, but the Windows AD Events module has not been loaded due to Safe Mode. See the [Agent Safe Mode](/docs/threatprevention/7.5/admin/agents/safemode.md) topic for additional information. - - Stopped (orange) – The Agent has been stopped and is not monitoring/blocking events - - Lost Connection (red) – The Agent is not actively communicating with the Enterprise Manager + - Stopped (orange) – The Agent has been stopped and isn't monitoring/blocking events + - Lost Connection (red) – The Agent isn't actively communicating with the Enterprise Manager - No Agent (gray) – a domain controller has been found within the targeted domain where the - Agent is not yet deployed + Agent isn't yet deployed - Address – IP address of the server where the Agent is deployed. Hover over data in this column to view the IP address with port @@ -130,17 +130,17 @@ This data grid employs features for sorting, filtering, searching, and more. See ## Agents Action Buttons -The following icons above the data grid enable you to perform various actions on the Agents +Use the following icons above the data grid to perform various actions on the Agents interface | Icon | Label | Action | | ---------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | ![Agents Interface - Export Agent List icon](/images/threatprevention/7.5/admin/agents/exporticon.webp) | Export Agent List… | Save the information to an XML file for export | | ![Agents Interface - Refresh Agent List icon](/images/threatprevention/7.5/admin/agents/refreshicon.webp) | Refresh Agent List… | Refresh the Agent information | -| ![Agents Interface - Update Logging Levels icon](/images/threatprevention/7.5/admin/agents/updateloggingicon.webp) | Update Logging Levels… | Configure the log levels for the Agent(s). It opens the [Log Level Configuration Window](/docs/threatprevention/7.5/admin/agents/agents-windows/loglevelconfiguration.md). | +| ![Agents Interface - Update Logging Levels icon](/images/threatprevention/7.5/admin/agents/updateloggingicon.webp) | Update Logging Levels… | Configure the log levels for the Agents. It opens the [Log Level Configuration Window](/docs/threatprevention/7.5/admin/agents/agents-windows/loglevelconfiguration.md). | | ![Agents Interface - Get Agent Log icon](/images/threatprevention/7.5/admin/agents/getagentlogicon.webp) | Get Agent Log… | Access Agent log files. See the [Access Agent Log Files](/docs/threatprevention/7.5/admin/agents/agents-windows/loglevelconfiguration.md#access-agent-log-files) topic for additional information. | | ![Agents Interface - Update Agent Installer icon](/images/threatprevention/7.5/admin/agents/updateinstallericon.webp) | Update Agent Installer | Check with Netwrix for a newer version of the Agent Installer according to the version in use. It opens the [Agent Installer Update Window](/docs/threatprevention/7.5/admin/agents/agents-windows/agentinstallerupdate.md). | -| ![Agents Interface - Configure Auto Deploy icon](/images/threatprevention/7.5/admin/agents/autodeployicon.webp) | Configure Auto Deploy | If enabled, the Agent is automatically deployed to all domain controllers without an Agent. This feature requires at least one Agent to be present in the domain in order to detect additional domain controllers. It opens the [Configure Auto Deploy Window](/docs/threatprevention/7.5/admin/agents/agents-windows/configureautodeploy.md). | +| ![Agents Interface - Configure Auto Deploy icon](/images/threatprevention/7.5/admin/agents/autodeployicon.webp) | Configure Auto Deploy | If enabled, the Agent is automatically deployed to all domain controllers without an Agent. This feature requires at least one Agent to be present in the domain to detect additional domain controllers. It opens the [Configure Auto Deploy Window](/docs/threatprevention/7.5/admin/agents/agents-windows/configureautodeploy.md). | | ![Agents Interface - Agent Enrollment Secret icon](/images/threatprevention/7.5/admin/agents/enrollmentsecreticon.webp) | Agent Enrollment Secret | Generate the enrollment secret used to deploy the Agent. Opens the [Enrollment Secret Configuration Window](/docs/threatprevention/7.5/admin/agents/agents-windows/enrollmentsecretconfiguration.md). | | ![Agents Interface - Deploy Agent icon](/images/threatprevention/7.5/admin/agents/deployagent.webp) | Deploy Agent | Deploy the Agent to selected servers. It opens the Deploy Agents wizard. See the [Deploy Agents](/docs/threatprevention/7.5/admin/agents/deploy/overview.md) topic for additional information. | @@ -155,14 +155,14 @@ The right-click menu contains the following selections: | Right-Click Command | Description | | ------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| Install Agent | Deploys the Agent to the desired machines. Opens the Deploy Agent wizard. See the [Deploy Agents](/docs/threatprevention/7.5/admin/agents/deploy/overview.md) topic for additional information. | +| Install Agent | Deploys the Agent to the selected machines. Opens the Deploy Agent wizard. See the [Deploy Agents](/docs/threatprevention/7.5/admin/agents/deploy/overview.md) topic for additional information. | | Uninstall Agent | Uninstalls a previously deployed Agent from its server. See the [Uninstall Agent](/docs/threatprevention/7.5/install/upgrade/uninstallagent.md) topic for additional information. | | Upgrade Agent | Upgrades the Agent to a newer version. See the [Upgrade Agent](/docs/threatprevention/7.5/install/upgrade/agent.md) topic for additional information. | | Upgrade ADMonitor | Updates the SI.ActiveDirectoryMonitor.dll (LSASS module) only rather than the entire Agent. See the [Upgrade ADMonitor](/docs/threatprevention/7.5/admin/agents/agent-management/upgradeadmonitor.md) topic for additional information. | | Update Agent Settings | Allows for modification of the Agent settings, such as the modules, Enterprise Manager address, or enabling/disabling the DNS Host Name Resolution option. It opens the Deploy Agent wizard. See the [Update Agent Settings](/docs/threatprevention/7.5/admin/agents/deploy/overview.md#update-agent-settings) topic for additional information. | -| Start Agent | Starts the Agent service on the selected machine(s). See the [Start Agent](/docs/threatprevention/7.5/admin/agents/agent-management/start.md) topic for additional information. | -| Stop Agent | Stops the Agent service on the selected machine(s). See the [Stop Agent](/docs/threatprevention/7.5/admin/agents/agent-management/stop.md) sections for additional information. | -| Start Pending Modules | Starts Agent service modules that did not start with the Agent due to a change in LSASS (only available on Agents configured to use Safe Mode). See the [Agent Safe Mode](/docs/threatprevention/7.5/admin/agents/safemode.md) topic and the [Start Pending Modules](/docs/threatprevention/7.5/admin/agents/agent-management/startpendingmodules.md) topic for additional information. | +| Start Agent | Starts the Agent service on the selected machines. See the [Start Agent](/docs/threatprevention/7.5/admin/agents/agent-management/start.md) topic for additional information. | +| Stop Agent | Stops the Agent service on the selected machines. See the [Stop Agent](/docs/threatprevention/7.5/admin/agents/agent-management/stop.md) sections for additional information. | +| Start Pending Modules | Starts Agent service modules that didn't start with the Agent due to a change in LSASS (only available on Agents configured to use Safe Mode). See the [Agent Safe Mode](/docs/threatprevention/7.5/admin/agents/safemode.md) topic and the [Start Pending Modules](/docs/threatprevention/7.5/admin/agents/agent-management/startpendingmodules.md) topic for additional information. | | Harden Agent | Protects an Agent from being altered, stopped, or started from within the local Service Control Manager. See the [Harden Agent](/docs/threatprevention/7.5/admin/agents/agent-management/harden.md) topic for additional information. | | Soften Agent | Unlocks the Agent so it can be controlled from within the local Service Control Manager. See the [Soften Agent](/docs/threatprevention/7.5/admin/agents/agent-management/soften.md) topic for additional information. | | Remove Server from List | Removes a server from the Agent data grid. If the server has a deployed Agent, it will be added back to the list the next time the Agent sends information to the Enterprise Manager. See the [Remove Server from List](/docs/threatprevention/7.5/admin/agents/agent-management/removeserver.md) topic for additional information. | @@ -170,14 +170,14 @@ The right-click menu contains the following selections: For certain actions, you can select multiple Agents listed in the data grid, to perform that action on all the selected Agents. The appropriate right-click menu options will not be grayed out if -multi-selection is available for the particular action. Agents must be in the same state in order to +multi-selection is available for the particular action. Agents must be in the same state to complete a multi-select action (for example, all selected Agents must be stopped to use the Start action). To perform centralized Agent maintenance from the Administration Console, you must have WMI enabled on the machine where the Agent is installed. The Soften Agent, Harden Agent, and Remove Server from List actions are an exception. When executing the other commands, the Administration Console uses -WMI to remotely query the registry on the target Agent machine(s) to understand where the Agent +WMI to remotely query the registry on the target Agent machines to understand where the Agent configuration files are located (install path). Next, WMI is used to stop the Agent service, modify the configuration files, and restart the Agent. @@ -188,14 +188,14 @@ article for additional information. ## Additional Agent Considerations -Below are some considerations: +Consider the following: - Occasionally a Microsoft Security Bulletin impacting LSASS can interfere with the Agent instrumentation resulting in LSASS shutting down. The Agent is configured to monitor for an LSASS process termination shortly after a server reboot. The [LSASS Process Terminated](/docs/threatprevention/7.5/troubleshooting/lsass.md) alert (Operations alert) is triggered in this event and the Agent is stopped. As a result, all monitoring/blocking by that Agent stops. - To resolve the issue, either upgrade to the latest version of the Agent or simply upgrade + To resolve the issue, either upgrade to the latest version of the Agent or upgrade SI.ActiveDirectoryMonitor.dll - commonly known as ADMonitor DLL (recommended). See the [Upgrade ADMonitor](/docs/threatprevention/7.5/admin/agents/agent-management/upgradeadmonitor.md)topic for additional information. @@ -210,7 +210,7 @@ Below are some considerations: - In addition to the LSASS process termination check, the Agent can be configured for a Safe Mode. In Safe Mode, the Agent records the version of the LSASS DLLs that it hooks into during installation. When an Agent is restarted, it compares the DLL versions with the recorded list. If - the versions do not match, the Windows AD Events monitoring module is not loaded. The Agent’s + the versions don't match, the Windows AD Events monitoring module isn't loaded. The Agent’s status in the Agents interface changes to Active (Modules Pending), and all Active Directory monitoring/blocking by that Agent stops. The 'Agent Started in AD Monitor pending mode' alert (Operations alert) is triggered in this event. To resolve the issue temporarily, the Threat diff --git a/docs/threatprevention/7.5/install/agent/manual/customcert.md b/docs/threatprevention/7.5/install/agent/customcert.md similarity index 83% rename from docs/threatprevention/7.5/install/agent/manual/customcert.md rename to docs/threatprevention/7.5/install/agent/customcert.md index 97febb74b9..92db7d5d34 100644 --- a/docs/threatprevention/7.5/install/agent/manual/customcert.md +++ b/docs/threatprevention/7.5/install/agent/customcert.md @@ -6,9 +6,7 @@ sidebar_position: 10 # Create Custom Managed Certificates for Each Agent -If "custom-managed" is selected for the CA certificate configuration during -[Manual Agent Deployment](/docs/threatprevention/7.5/install/agent/manual/manual.md), use the `SIAgentCert.exe` command line utility to facilitate -the creation of certificates for each Agent. +Use the `SIAgentCert.exe` command line utility to create certificates for each Agent. :::note As a requirement for using custom managed certificates, you must provide the Enterprise @@ -29,7 +27,7 @@ The `SIAgentCert.exe` utility is located in the following folder: `…\Netwrix\Netwrix Threat Prevention\SIWindowsAgent` -Follow the steps to run the `SIAgentCert.exe` utility. +To run the `SIAgentCert.exe` utility: **Step 1 –** Open a command prompt on the machine where the Agent is deployed and run the SIAgentCert.exe utility as an Administrator. The utility checks for the following files in the @@ -39,14 +37,14 @@ SIAgentCert.exe utility as an Administrator. The utility checks for the followin - agentcsr.pem - key.pem -If these files are not present because no certificates were previously created, the utility +If these files aren't present because no certificates were previously created, the utility generates an `agent-key.pem` file and an `agent-csr.pem` and places them in the CertsInfo folder. **Step 2 –** The `SIAgentCert.exe` utility prompts you to sign the certificate using the generated `agent-csr.pem` file. :::note -It is the customer's responsibility to supply the `agent-csr.pem` file to their +The customer must supply the `agent-csr.pem` file to their certificate authority to create a signed file. ::: diff --git a/docs/threatprevention/7.5/install/agent/manual/manual.md b/docs/threatprevention/7.5/install/agent/manual.md similarity index 91% rename from docs/threatprevention/7.5/install/agent/manual/manual.md rename to docs/threatprevention/7.5/install/agent/manual.md index 779d3152c1..ac33db5a9d 100644 --- a/docs/threatprevention/7.5/install/agent/manual/manual.md +++ b/docs/threatprevention/7.5/install/agent/manual.md @@ -6,12 +6,12 @@ sidebar_position: 10 # Manual Agent Deployment -The Threat PreventionAgent must be installed to the appropriate systems for monitoring. See the +You must install the Threat Prevention Agent on the appropriate systems for monitoring. See the [Agent Information](/docs/threatprevention/7.5/install/agent/overview.md) topic for specifics on where to deploy. The Threat Prevention Agent can be deployed through any of the following methods: -- Deploy the Agent to server(s) through the Administration Console – You can deploy the Agent to one +- Deploy the Agent to servers through the Administration Console – You can deploy the Agent to one or multiple servers through the Administration Console :::info @@ -25,12 +25,12 @@ See the [Agents Interface](/docs/threatprevention/7.5/admin/agents/overview.md) [Deploy Agents](/docs/threatprevention/7.5/admin/agents/deploy/overview.md) topic for additional information to deploy the Agent through the Administration Console. -Follow the steps to manually deploy the Agent. +To manually deploy the Agent: :::note Manually deploying the Agent requires an Enrollment Secret, which is a limited-life (1 hour) password generated by the Enterprise Manager. The Agent Installer uses it to ensure that the -Agent is connected to a legitimate Enterprise Manager. Prior to launching the Threat Prevention +Agent is connected to a legitimate Enterprise Manager. Before launching the Threat Prevention Windows Agent Setup wizard, note the values for the enrollment secret and the EM certificate. See the [Enrollment Secret Configuration Window](/docs/threatprevention/7.5/admin/agents/agents-windows/enrollmentsecretconfiguration.md) @@ -66,7 +66,7 @@ location. ![Change Destination Folder Page](/images/threatprevention/7.5/install/agent/changedestination.webp) -> > - Use the Look In field to select the desired installation folder. +> > - Use the Look In field to select the installation folder you want. > > - When the Folder name is as desired, click **OK**. The wizard returns to the Destination Folder > > page. > > - Click **Next**. @@ -136,13 +136,13 @@ product to enable communication with it. the LSASS DLL versions has been modified since the last time the Threat Prevention Windows Agent service was started. - Start Agent Service – This option starts the Threat Prevention Windows Agent service after the - Agent is installed. If the Threat Prevention Windows Agent service is not started during + Agent is installed. If the Threat Prevention Windows Agent service isn't started during installation, the Agent requires a manual start or needs to be started automatically after a server reboot. Until the Agent is started, no activity monitoring or blocking occurs. :::note If **Custom-managed** is selected on the CA Certificate Configuration page, the - **Start Agent Service** checkbox is disabled because Agent installer does not obtain a + **Start Agent Service** checkbox is disabled because Agent installer doesn't obtain a signed certificate from Enterprise Manager in the custom-managed mode. After installing the Agent, you must create and provide certificates signed by your certificate authority. ::: @@ -162,9 +162,9 @@ the same value displayed in the in the Administration Console. :::note -This page is not displayed when "Custom-managed" is selected on the CA Certificate +This page isn't displayed when "Custom-managed" is selected on the CA Certificate Configuration wizard page .It is also not displayed when the Agent is reinstalled on a machine and -the Certsinfo folder was not manually deleted, in which case the original certificates are re-used. +the Certsinfo folder wasn't manually deleted, in which case the original certificates are re-used. The Certsinfo folder is located at: …\Netwrix\Netwrix Threat Prevention\SIWindowsAgent\CertsInfo\ ::: @@ -181,7 +181,7 @@ The Certsinfo folder is located at: …\Netwrix\Netwrix Threat Prevention\SIWind ![Threat Prevention Windows Agent Setup wizard - Select Event Sources page](/images/threatprevention/7.5/install/agent/eventsources.webp) **Step 9 –** On the Select Event Sources page, select the types of events to be monitored by this -Agent. The installer grays out options that are not applicable to the server where the Agent is +Agent. The installer grays out options that aren't applicable to the server where the Agent is being deployed. Click **Next**. - Windows Event Logs – Available for legacy versions. Option should be grayed-out. @@ -195,10 +195,10 @@ being deployed. Click **Next**. and the Threat Prevention for Exchange solutions. Also available as part of the Activity Monitor for Active Directory solution. - Select this component if the system the Agent is being installed on is an Active Directory - domain controller. This option is grayed-out if the target system is not a domain controller. + domain controller. This option is grayed-out if the target system isn't a domain controller. - Exchange Server Monitoring – Available as part of the Threat Prevention for Exchange solution. - Select this component if the system where the Agent is being installed is running the Exchange - Server. This option will be grayed-out if this Agent is not being installed on an Exchange + Server. This option will be grayed-out if this Agent isn't being installed on an Exchange Server. - NetApp Security Event Log – Available for legacy versions. Option should be grayed-out. - Workstation Events – Available for legacy versions. Option should be grayed-out. @@ -215,4 +215,4 @@ Successful page is displayed. If the certificates are managed by Threat Prevention, Agent deployment is completed. If the custom-managed certificate option was selected, see the -[Create Custom Managed Certificates for Each Agent](/docs/threatprevention/7.5/install/agent/manual/customcert.md) topic for additional information. +[Create Custom Managed Certificates for Each Agent](/docs/threatprevention/7.5/install/agent/customcert.md) topic for additional information. diff --git a/docs/threatprevention/7.5/install/agent/manual/_category_.json b/docs/threatprevention/7.5/install/agent/manual/_category_.json deleted file mode 100644 index 6ead0f6f6e..0000000000 --- a/docs/threatprevention/7.5/install/agent/manual/_category_.json +++ /dev/null @@ -1,10 +0,0 @@ -{ - "label": "Manual Agent Deployment", - "position": 10, - "collapsed": true, - "collapsible": true, - "link": { - "type": "doc", - "id": "manual" - } -} \ No newline at end of file diff --git a/docs/threatprevention/7.5/install/migrateemserver.md b/docs/threatprevention/7.5/install/migrateemserver.md index 678af65aba..19f3679fc6 100644 --- a/docs/threatprevention/7.5/install/migrateemserver.md +++ b/docs/threatprevention/7.5/install/migrateemserver.md @@ -6,11 +6,11 @@ sidebar_position: 100 # Migrate the Enterprise Manager Server -Follow the steps to move the Threat Prevention7.5 Enterprise Manager to a different server when -using default certificates. +To move the Threat Prevention 7.5 Enterprise Manager to a different server when +using default certificates, complete the following steps: :::warning -Do not remove the Enterprise Manager from the current machine until the migration +Don't remove the Enterprise Manager from the current machine until the migration process is complete. ::: @@ -37,7 +37,7 @@ folder. - Em-crt.pem - Em-key.pem -Then, follow these steps to migrate the “secret.dpapi” file (do not copy). +Then, migrate the “secret.dpapi” file (don't copy) as follows: 1. On the original Enterprise Manager machine: “SecretMgr.exe –e myOutFile” @@ -61,7 +61,7 @@ Then, follow these steps to migrate the “secret.dpapi” file (do not copy). **Step 3 –** Start the Threat Prevention Enterprise Manager service on the new machine. **Step 4 –** On the original Enterprise Manager machine, launch the Administration Console and -follow these steps to update the Enterprise Manager info for each Agent. +update the Enterprise Manager info for each Agent as follows: 1. Click **Agents** in the left pane to open the [Agents Interface](/docs/threatprevention/7.5/admin/agents/overview.md). 2. Right-click an Agent in the grid and select **Update Agent Settings**. You can also select @@ -73,11 +73,11 @@ follow these steps to update the Enterprise Manager info for each Agent. Address/Name field and click **Next**. 4. Verify that the update task completes for each Agent successfully. -At this point, the Agents should get displayed in the Administration Console on the new Enterprise +At this point, the Agents should appear in the Administration Console on the new Enterprise Manager machine. :::note -If you cannot use the Administration Console on the original Enterprise Manager machine, +If you can't use the Administration Console on the original Enterprise Manager machine, then on each machine where the Agent is deployed, you can manually edit the “SIWindowsAgent.exe.config” file to update the following entry with the IP address or name of the new Enterprise Manager. @@ -96,7 +96,7 @@ If Netwrix Threat Prevention is configured to use customer supplied certificates recommended that you uninstall, then re-enroll and re-install all Agents with new certificates. This is because customer supplied certificates usually have the FQDN info of the Enterprise Manager and the new Enterprise Manager machine would typically have a different DNS name. See the -[Create Custom Managed Certificates for Each Agent](/docs/threatprevention/7.5/install/agent/manual/customcert.md) topic for additional +[Create Custom Managed Certificates for Each Agent](/docs/threatprevention/7.5/install/agent/customcert.md) topic for additional information. ::: diff --git a/docs/threatprevention/7.5/requirements/ports.md b/docs/threatprevention/7.5/requirements/ports.md index 61c00eb9ef..17167f4fde 100644 --- a/docs/threatprevention/7.5/requirements/ports.md +++ b/docs/threatprevention/7.5/requirements/ports.md @@ -11,7 +11,7 @@ network requirements. If choosing the Create Windows Firewall Rules option eithe [Application Server Install](/docs/threatprevention/7.5/install/application.md), in step 6 of the [Administration Console Remote Install](/docs/threatprevention/7.5/install/adminconsole.md), on the Set Options page of the [Deploy Agents Wizard](/docs/threatprevention/7.5/admin/agents/deploy/overview.md#deploy-agents-wizard), or in step 7 of a -[Manual Agent Deployment](/docs/threatprevention/7.5/install/agent/manual/manual.md), then Threat Prevention will create the +[Manual Agent Deployment](/docs/threatprevention/7.5/install/agent/manual.md), then Threat Prevention will create the necessary Windows firewall rules. If using a third party firewall, it will be necessary to manually set these. @@ -138,7 +138,7 @@ are required for communication between the Agent server and the Netwrix Activity The Windows firewall rules need to be configured on the Windows server, which require certain inbound rules be created if the scans are running in applet mode. These scans operate over a default -port range, which cannot be specified via an inbound rule. For more information, see the Microsoft +port range, which can't be specified via an inbound rule. For guidance on connecting to WMI on a remote computer, see the Microsoft [Connecting to WMI on a Remote Computer]() article. @@ -202,7 +202,7 @@ Agent server and the target NetApp Data ONTAP 7-Mode device: Activity Monitor. :::note -If either HTTP or HTTPS are not enabled, the FPolicy on the NetApp Data ONTAP 7-Mode +If either HTTP or HTTPS aren't enabled, the FPolicy on the NetApp Data ONTAP 7-Mode device must be configured manually. Also, the External Engine will not reconnect automatically in the case of a server reboot or service restart. ::: @@ -223,7 +223,7 @@ Agent server and the target NetApp Data ONTAP Cluster-Mode device: Activity Monitor. :::note -If either HTTP or HTTPS are not enabled, the FPolicy on the NetApp Data ONTAP 7-Mode +If either HTTP or HTTPS aren't enabled, the FPolicy on the NetApp Data ONTAP 7-Mode device must be configured manually. Also, the External Engine will not reconnect automatically in the case of a server reboot or service restart. ::: @@ -237,7 +237,7 @@ Agent server and the target Panzura device: | Communication Direction | Protocol | Ports | Description | | ------------------------------------------ | ------------- | ----- | ----------------------- | | Activity Agent Server to Panzura | HTTPS | 443 | Panzura API | -| Panzura filers to to Activity Agent Server | AMQP over TCP | 4497 | Panzura Event Reporting | +| Panzura filers to Activity Agent Server | AMQP over TCP | 4497 | Panzura Event Reporting | Protect the port with a username and password. The credentials will be configured in Panzura. diff --git a/docs/threatprevention/7.5/troubleshooting/enterprisemanagercommunication.md b/docs/threatprevention/7.5/troubleshooting/enterprisemanagercommunication.md index e276212e26..6ed54d700c 100644 --- a/docs/threatprevention/7.5/troubleshooting/enterprisemanagercommunication.md +++ b/docs/threatprevention/7.5/troubleshooting/enterprisemanagercommunication.md @@ -17,7 +17,7 @@ Agent, the console and Agent will fail to connect to Enterprise Manager. :::note To configure custom managed certificates for the Enterprise Manager and the Agent, see the [Certificate Management Wizard](/docs/threatprevention/7.5/install/certificatemanagementwizard.md) and -[Create Custom Managed Certificates for Each Agent](/docs/threatprevention/7.5/install/agent/manual/customcert.md) topics +[Create Custom Managed Certificates for Each Agent](/docs/threatprevention/7.5/install/agent/customcert.md) topics respectively. ::: @@ -25,11 +25,11 @@ respectively. You must provide the Enterprise Manager server DNS name when you install the following: - Threat Prevention server (see the [Application Server Install](/docs/threatprevention/7.5/install/application.md) topic) -- Threat Prevention Agent (see the [Manual Agent Deployment](/docs/threatprevention/7.5/install/agent/manual/manual.md) topic) +- Threat Prevention Agent (see the [Manual Agent Deployment](/docs/threatprevention/7.5/install/agent/manual.md) topic) - Remote instance of the Administration Console (see the [Administration Console Remote Install](/docs/threatprevention/7.5/install/adminconsole.md) topic) -If you have already installed the above with the IP address of the Enterprise Manager server, you +If you have already installed these components with the IP address of the Enterprise Manager server, you can change it to the DNS name post-install by modifying the following config files: - SIWinConsole.exe.Config @@ -37,7 +37,7 @@ can change it to the DNS name post-install by modifying the following config fil - SIWindowsAgent.exe.config Path: `…\Netwrix\Netwrix Threat Prevention\SIWindowsAgent\SIWindowsAgent.exe.config` -Follow the steps to modify these files. +To modify these files, complete the following steps: **Step 1 –** Open the SIWindowsAgent.exe.config or SIWinConsole.exe.Config file. diff --git a/docs/threatprevention/8.0/admin/agents/agents-windows/enrollmentsecretconfiguration.md b/docs/threatprevention/8.0/admin/agents/agents-windows/enrollmentsecretconfiguration.md index bbb0c304ed..bae9e3638d 100644 --- a/docs/threatprevention/8.0/admin/agents/agents-windows/enrollmentsecretconfiguration.md +++ b/docs/threatprevention/8.0/admin/agents/agents-windows/enrollmentsecretconfiguration.md @@ -15,16 +15,16 @@ enrollment secret is applied depends on the method used to install the Agent. and use a new enrollment secret as part of automated Agent installation. - If installing the Agent manually, the enrollment secret must be entered in the Certificates window of the Agent Setup wizard during installation. See the - [Manual Agent Deployment](/docs/threatprevention/8.0/install/agent/manual/manual.md) topic for additional information. + [Manual Agent Deployment](/docs/threatprevention/8.0/install/agent/manual.md) topic for additional information. -Follow the steps to generate the enrollment secret. +To generate the enrollment secret, complete the following steps: **Step 1 –** Click **Agents** in the left pane to launch the Agents interface. Then click **Agent Enrollment Secret** to launch the Enrollment Secret Configuration window. ![Enrollment Secret Configuration window](/images/threatprevention/8.0/admin/agents/window/enrollmentsecret.webp) -The Enrollment Secret Configuration window enables you to generate the enrollment secret required to +Use the Enrollment Secret Configuration window to generate the enrollment secret required to manually deploy the Agent. It has the following fields: - Enrollment Secret – A limited-life (1 hour) password generated by the Enterprise Manager. The diff --git a/docs/threatprevention/8.0/admin/agents/deploy/overview.md b/docs/threatprevention/8.0/admin/agents/deploy/overview.md index b9267ecc13..3e27047046 100644 --- a/docs/threatprevention/8.0/admin/agents/deploy/overview.md +++ b/docs/threatprevention/8.0/admin/agents/deploy/overview.md @@ -8,7 +8,7 @@ sidebar_position: 20 The Threat Prevention Agent can be deployed through any of the following methods: -- Deploy the Agent to server(s) through the Administration Console – You can deploy the Agent to one +- Deploy the Agent to servers through the Administration Console – You can deploy the Agent to one or multiple servers through the Administration Console :::info @@ -18,30 +18,30 @@ The Threat Prevention Agent can be deployed through any of the following methods - Manually through the Windows Agent Setup Wizard – Run the Agent executable to launch this wizard -See the [Manual Agent Deployment](/docs/threatprevention/8.0/install/agent/manual/manual.md) topic for additional +See the [Manual Agent Deployment](/docs/threatprevention/8.0/install/agent/manual.md) topic for additional information. ## Deploy Agents Wizard -The Deploy Agents wizard enables you to deploy Agents from the Administration Console. Computers +Use the Deploy Agents wizard to deploy Agents from the Administration Console. Computers targeted for Agent deployment must meet the minimum .NET Framework version required by the Agent or the deployment fails. Remember to check server requirements before deploying the Agent, including compatibility with other security products. See the [Agent Server Requirements](/docs/threatprevention/8.0/requirements/agent/agent.md) topic for additional information. :::note -The wizard does not block access to the Administration Console and can be minimized while +The wizard doesn't block access to the Administration Console and can be minimized while actions are in progress. If this wizard is hidden by clicking outside of the dialog box, a flashing blue link displays on the upper right corner of the interface with the action name displayed. Click -this link to bring back the focus to the wizard. +the flashing blue link to bring back the focus to the wizard. ::: The Deploy Agents wizard consists of four windows: Select Computers, Set Options, Prerequisites Check, and Installing. -Follow the steps to deploy the Agent from the Administration Console to a new or existing machine -using the Deploy Agents wizard. +To deploy the Agent from the Administration Console to a new or existing machine +using the Deploy Agents wizard, complete the following steps: :::warning Closing the Administration Console while this action is in process causes problems with @@ -63,13 +63,13 @@ tabs on the window. See the [Select Computers Window](/docs/threatprevention/8.0 information. Click **Next**. If you open this window through the [Right-Click Menu](/docs/threatprevention/8.0/admin/agents/overview.md#right-click-menu) action, the -list is auto-populated with the computer(s) selected on the Agents interface. +list is auto-populated with the computers selected on the Agents interface. ![Deploy Agents wizard – Set Options page](/images/threatprevention/8.0/admin/agents/deploy/setoptions.webp) **Step 4 –** On the Set Options window, enter the credentials required to deploy the Agent on the -selected machine(s). Review the Enterprise Manager IP address/name and port for accuracy and select -the desired modules to install for this Agent. You can also set other properties for the Agent. See +selected machines. Review the Enterprise Manager IP address/name and port for accuracy and select +the modules you want to install for this Agent. You can also set other properties for the Agent. See the [Set Options Window ](/docs/threatprevention/8.0/admin/agents/deploy/setoptions.md)topic for additional information. **Step 5 –** Once configurations are set, click **Next**. @@ -83,16 +83,16 @@ for additional information. ![Deploy Agents wizard – Installing page](/images/threatprevention/8.0/admin/agents/deploy/installing.webp) -**Step 7 –** The Installing window performs the installation and displays whether or not the action +**Step 7 –** The Installing window performs the installation and displays whether the action was successful. See the [Installing Window ](/docs/threatprevention/8.0/admin/agents/deploy/installing.md) topic for additional information. **Step 8 –** When the task is successfully completed, click **Finish** to close the window. -The Agent will be listed in the table on the Agents interface. +The Agent appears in the table on the Agents interface. :::note If the server where the Agent is deployed has multiple network adapters (multi-homed), -then it is necessary to bind the Agent to an adapter that can communicate with the Enterprise +then you must bind the Agent to an adapter that can communicate with the Enterprise Manager. See the [Bind To](/docs/threatprevention/8.0/troubleshooting/agentcommunication.md#bind-to) topic for additional information. ::: @@ -100,7 +100,7 @@ additional information. ## Update Agent Settings -Follow the steps to update the settings for a deployed Agent through the Agents interface. +To update the settings for a deployed Agent through the Agents interface, complete the following steps: **Step 1 –** Click Agents in the left pane to launch the Agents interface. @@ -113,7 +113,7 @@ automatically added to the Update Agent settings on These Computers box. See the **Step 4 –** On the Set Options window, ensure the proper credentials, modules, and Enterprise Manager location are accurate alongside additional options. To make changes to the settings, uncheck -the **Keep Existing Settings** box. Make necessary updates as needed. See the +the **Keep Existing Settings** box. Make the necessary updates. See the [Set Options Window ](/docs/threatprevention/8.0/admin/agents/deploy/setoptions.md) topic for additional information. **Step 5 –** On the Prerequisites Check window, the credentials provided on the Set Options window @@ -125,7 +125,7 @@ either succeed or fail during a prerequisites or verification check. See the status messages display: - Failed – Read the failure message and either click **Back** to provide new credentials or click - **Finish** to close the window and ensure any error messages are taken care of prior to next + **Finish** to close the window and resolve any error messages before the next attempt - Completed – Indicates that the Agent has been successfully updated diff --git a/docs/threatprevention/8.0/admin/agents/overview.md b/docs/threatprevention/8.0/admin/agents/overview.md index 1b30fbd758..00044bcbba 100644 --- a/docs/threatprevention/8.0/admin/agents/overview.md +++ b/docs/threatprevention/8.0/admin/agents/overview.md @@ -6,14 +6,14 @@ sidebar_position: 40 # Agents Interface -The Agents interface allows you to quickly view, deploy, and manage Agents from a centralized +Use the Agents interface to quickly view, deploy, and manage Agents from a centralized location to the targeted domain controllers in a domain. The Agent must be deployed on all domain -controllers that you want to receive event data for. Once one or more Agent(s) are deployed to a +controllers that you want to receive event data for. Once one or more Agents are deployed to a domain, it becomes known as a targeted domain. The Threat Prevention Agent can be deployed through any of the following methods: -- Deploy the Agent to server(s) through the Administration Console – You can deploy the Agent to one +- Deploy the Agent to servers through the Administration Console – You can deploy the Agent to one or multiple servers through the Administration Console :::info @@ -24,7 +24,7 @@ The Threat Prevention Agent can be deployed through any of the following methods - Manually through the Windows Agent Setup Wizard – Run the Agent executable to launch this wizard See the [Deploy Agents](/docs/threatprevention/8.0/admin/agents/deploy/overview.md) and -[Manual Agent Deployment](/docs/threatprevention/8.0/install/agent/manual/manual.md) topics for additional information. +[Manual Agent Deployment](/docs/threatprevention/8.0/install/agent/manual.md) topics for additional information. Click **Agents** in the left pane to open the Agents interface. @@ -48,7 +48,7 @@ information for an Agent: ![Warning Symbol for an Agent](/images/threatprevention/8.0/admin/agents/warningsymbol.webp) - - AD Event Latency – Time difference between when the event was detected by the Agent and when + - AD Event Latency – Time difference between when the Agent detected the event and when the Enterprise Manager received it :::note @@ -61,7 +61,7 @@ information for an Agent: ::: -- FSMO Roles – The FSMO (Flexible Single Master Operation) role(s) currently assigned to the domain +- FSMO Roles – The FSMO (Flexible Single Master Operation) roles assigned to the domain controller where the Agent is deployed. Role names are displayed as abbreviations. For example, 'SM' is displayed for the Schema Master role. Hover over data in this column to view the full names. @@ -86,10 +86,10 @@ information for an Agent: - Active (Modules Pending) – The Agent is active, but the Windows AD Events module has not been loaded due to Safe Mode. See the [Agent Safe Mode](/docs/threatprevention/8.0/admin/agents/safemode.md) topic for additional information. - - Stopped (orange) – The Agent has been stopped and is not monitoring/blocking events - - Lost Connection (red) – The Agent is not actively communicating with the Enterprise Manager + - Stopped (orange) – The Agent has been stopped and isn't monitoring/blocking events + - Lost Connection (red) – The Agent isn't actively communicating with the Enterprise Manager - No Agent (gray) – a domain controller has been found within the targeted domain where the - Agent is not yet deployed + Agent isn't yet deployed - Address – IP address of the server where the Agent is deployed. Hover over data in this column to view the IP address with port @@ -130,17 +130,17 @@ This data grid employs features for sorting, filtering, searching, and more. See ## Agents Action Buttons -The following icons above the data grid enable you to perform various actions on the Agents +Use the following icons above the data grid to perform various actions on the Agents interface | Icon | Label | Action | | ---------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | ![Agents Interface - Export Agent List icon](/images/threatprevention/8.0/admin/agents/exporticon.webp) | Export Agent List… | Save the information to an XML file for export | | ![Agents Interface - Refresh Agent List icon](/images/threatprevention/8.0/admin/agents/refreshicon.webp) | Refresh Agent List… | Refresh the Agent information | -| ![Agents Interface - Update Logging Levels icon](/images/threatprevention/8.0/admin/agents/updateloggingicon.webp) | Update Logging Levels… | Configure the log levels for the Agent(s). It opens the [Log Level Configuration Window](/docs/threatprevention/8.0/admin/agents/agents-windows/loglevelconfiguration.md). | +| ![Agents Interface - Update Logging Levels icon](/images/threatprevention/8.0/admin/agents/updateloggingicon.webp) | Update Logging Levels… | Configure the log levels for the Agents. It opens the [Log Level Configuration Window](/docs/threatprevention/8.0/admin/agents/agents-windows/loglevelconfiguration.md). | | ![Agents Interface - Get Agent Log icon](/images/threatprevention/8.0/admin/agents/getagentlogicon.webp) | Get Agent Log… | Access Agent log files. See the [Access Agent Log Files](/docs/threatprevention/8.0/admin/agents/agents-windows/loglevelconfiguration.md#access-agent-log-files) topic for additional information. | | ![Agents Interface - Update Agent Installer icon](/images/threatprevention/8.0/admin/agents/updateinstallericon.webp) | Update Agent Installer | Check with Netwrix for a newer version of the Agent Installer according to the version in use. It opens the [Agent Installer Update Window](/docs/threatprevention/8.0/admin/agents/agents-windows/agentinstallerupdate.md). | -| ![Agents Interface - Configure Auto Deploy icon](/images/threatprevention/8.0/admin/agents/autodeployicon.webp) | Configure Auto Deploy | If enabled, the Agent is automatically deployed to all domain controllers without an Agent. This feature requires at least one Agent to be present in the domain in order to detect additional domain controllers. It opens the [Configure Auto Deploy Window](/docs/threatprevention/8.0/admin/agents/agents-windows/configureautodeploy.md). | +| ![Agents Interface - Configure Auto Deploy icon](/images/threatprevention/8.0/admin/agents/autodeployicon.webp) | Configure Auto Deploy | If enabled, the Agent is automatically deployed to all domain controllers without an Agent. This feature requires at least one Agent to be present in the domain to detect additional domain controllers. It opens the [Configure Auto Deploy Window](/docs/threatprevention/8.0/admin/agents/agents-windows/configureautodeploy.md). | | ![Agents Interface - Agent Enrollment Secret icon](/images/threatprevention/8.0/admin/agents/enrollmentsecreticon.webp) | Agent Enrollment Secret | Generate the enrollment secret used to deploy the Agent. Opens the [Enrollment Secret Configuration Window](/docs/threatprevention/8.0/admin/agents/agents-windows/enrollmentsecretconfiguration.md). | | ![Agents Interface - Deploy Agent icon](/images/threatprevention/8.0/admin/agents/deployagent.webp) | Deploy Agent | Deploy the Agent to selected servers. It opens the Deploy Agents wizard. See the [Deploy Agents](/docs/threatprevention/8.0/admin/agents/deploy/overview.md) topic for additional information. | @@ -155,14 +155,14 @@ The right-click menu contains the following selections: | Right-Click Command | Description | | ------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| Install Agent | Deploys the Agent to the desired machines. Opens the Deploy Agent wizard. See the [Deploy Agents](/docs/threatprevention/8.0/admin/agents/deploy/overview.md) topic for additional information. | +| Install Agent | Deploys the Agent to the selected machines. Opens the Deploy Agent wizard. See the [Deploy Agents](/docs/threatprevention/8.0/admin/agents/deploy/overview.md) topic for additional information. | | Uninstall Agent | Uninstalls a previously deployed Agent from its server. See the [Uninstall Agent](/docs/threatprevention/8.0/install/upgrade/uninstallagent.md) topic for additional information. | | Upgrade Agent | Upgrades the Agent to a newer version. See the [Upgrade Agent](/docs/threatprevention/8.0/install/upgrade/agent.md) topic for additional information. | | Upgrade ADMonitor | Updates the SI.ActiveDirectoryMonitor.dll (LSASS module) only rather than the entire Agent. See the [Upgrade ADMonitor](/docs/threatprevention/8.0/admin/agents/agent-management/upgradeadmonitor.md) topic for additional information. | | Update Agent Settings | Allows for modification of the Agent settings, such as the modules, Enterprise Manager address, or enabling/disabling the DNS Host Name Resolution option. It opens the Deploy Agent wizard. See the [Update Agent Settings](/docs/threatprevention/8.0/admin/agents/deploy/overview.md#update-agent-settings) topic for additional information. | -| Start Agent | Starts the Agent service on the selected machine(s). See the [Start Agent](/docs/threatprevention/8.0/admin/agents/agent-management/start.md) topic for additional information. | -| Stop Agent | Stops the Agent service on the selected machine(s). See the [Stop Agent](/docs/threatprevention/8.0/admin/agents/agent-management/stop.md) sections for additional information. | -| Start Pending Modules | Starts Agent service modules that did not start with the Agent due to a change in LSASS (only available on Agents configured to use Safe Mode). See the [Agent Safe Mode](/docs/threatprevention/8.0/admin/agents/safemode.md) topic and the [Start Pending Modules](/docs/threatprevention/8.0/admin/agents/agent-management/startpendingmodules.md) topic for additional information. | +| Start Agent | Starts the Agent service on the selected machines. See the [Start Agent](/docs/threatprevention/8.0/admin/agents/agent-management/start.md) topic for additional information. | +| Stop Agent | Stops the Agent service on the selected machines. See the [Stop Agent](/docs/threatprevention/8.0/admin/agents/agent-management/stop.md) sections for additional information. | +| Start Pending Modules | Starts Agent service modules that didn't start with the Agent due to a change in LSASS (only available on Agents configured to use Safe Mode). See the [Agent Safe Mode](/docs/threatprevention/8.0/admin/agents/safemode.md) topic and the [Start Pending Modules](/docs/threatprevention/8.0/admin/agents/agent-management/startpendingmodules.md) topic for additional information. | | Harden Agent | Protects an Agent from being altered, stopped, or started from within the local Service Control Manager. See the [Harden Agent](/docs/threatprevention/8.0/admin/agents/agent-management/harden.md) topic for additional information. | | Soften Agent | Unlocks the Agent so it can be controlled from within the local Service Control Manager. See the [Soften Agent](/docs/threatprevention/8.0/admin/agents/agent-management/soften.md) topic for additional information. | | Remove Server from List | Removes a server from the Agent data grid. If the server has a deployed Agent, it will be added back to the list the next time the Agent sends information to the Enterprise Manager. See the [Remove Server from List](/docs/threatprevention/8.0/admin/agents/agent-management/removeserver.md) topic for additional information. | @@ -170,14 +170,14 @@ The right-click menu contains the following selections: For certain actions, you can select multiple Agents listed in the data grid, to perform that action on all the selected Agents. The appropriate right-click menu options will not be grayed out if -multi-selection is available for the particular action. Agents must be in the same state in order to +multi-selection is available for the particular action. Agents must be in the same state to complete a multi-select action (for example, all selected Agents must be stopped to use the Start action). To perform centralized Agent maintenance from the Administration Console, you must have WMI enabled on the machine where the Agent is installed. The Soften Agent, Harden Agent, and Remove Server from List actions are an exception. When executing the other commands, the Administration Console uses -WMI to remotely query the registry on the target Agent machine(s) to understand where the Agent +WMI to remotely query the registry on the target Agent machines to understand where the Agent configuration files are located (install path). Next, WMI is used to stop the Agent service, modify the configuration files, and restart the Agent. @@ -188,14 +188,14 @@ article for additional information. ## Additional Agent Considerations -Below are some considerations: +Consider the following: - Occasionally a Microsoft Security Bulletin impacting LSASS can interfere with the Agent instrumentation resulting in LSASS shutting down. The Agent is configured to monitor for an LSASS process termination shortly after a server reboot. The [LSASS Process Terminated](/docs/threatprevention/8.0/troubleshooting/lsass.md) alert (Operations alert) is triggered in this event and the Agent is stopped. As a result, all monitoring/blocking by that Agent stops. - To resolve the issue, either upgrade to the latest version of the Agent or simply upgrade + To resolve the issue, either upgrade to the latest version of the Agent or upgrade SI.ActiveDirectoryMonitor.dll - commonly known as ADMonitor DLL (recommended). See the [Upgrade ADMonitor](/docs/threatprevention/8.0/admin/agents/agent-management/upgradeadmonitor.md)topic for additional information. @@ -210,7 +210,7 @@ Below are some considerations: - In addition to the LSASS process termination check, the Agent can be configured for a Safe Mode. In Safe Mode, the Agent records the version of the LSASS DLLs that it hooks into during installation. When an Agent is restarted, it compares the DLL versions with the recorded list. If - the versions do not match, the Windows AD Events monitoring module is not loaded. The Agent’s + the versions don't match, the Windows AD Events monitoring module isn't loaded. The Agent’s status in the Agents interface changes to Active (Modules Pending), and all Active Directory monitoring/blocking by that Agent stops. The 'Agent Started in AD Monitor pending mode' alert (Operations alert) is triggered in this event. To resolve the issue temporarily, the Threat diff --git a/docs/threatprevention/8.0/install/agent/manual/customcert.md b/docs/threatprevention/8.0/install/agent/customcert.md similarity index 79% rename from docs/threatprevention/8.0/install/agent/manual/customcert.md rename to docs/threatprevention/8.0/install/agent/customcert.md index e2faf1d08a..7c87a8c7be 100644 --- a/docs/threatprevention/8.0/install/agent/manual/customcert.md +++ b/docs/threatprevention/8.0/install/agent/customcert.md @@ -6,9 +6,8 @@ sidebar_position: 10 # Create Custom Managed Certificates for Each Agent -If "custom-managed" is selected for the CA certificate configuration during -[Manual Agent Deployment](/docs/threatprevention/8.0/install/agent/manual/manual.md), use the `SIAgentCert.exe` command line utility to facilitate -the creation of certificates for each Agent. +Use the `SIAgentCert.exe` command line utility to create certificates +for each Agent. :::note As a requirement for using custom managed certificates, you must provide the Enterprise @@ -29,7 +28,7 @@ The `SIAgentCert.exe` utility is located in the following folder: `…\Netwrix\Netwrix Threat Prevention\SIWindowsAgent` -Follow the steps to run the `SIAgentCert.exe` utility. +To run the `SIAgentCert.exe` utility: **Step 1 –** Open a command prompt on the machine where the Agent is deployed and run the SIAgentCert.exe utility as an Administrator. The utility checks for the following files in the @@ -39,20 +38,19 @@ SIAgentCert.exe utility as an Administrator. The utility checks for the followin - agentcsr.pem - key.pem -If these files are not present because no certificates were previously created, the utility +If these files aren't present because no certificates were previously created, the utility generates an `agent-key.pem` file and an `agent-csr.pem` and places them in the CertsInfo folder. **Step 2 –** The `SIAgentCert.exe` utility prompts you to sign the certificate using the generated `agent-csr.pem` file. :::note -It is the customer's responsibility to supply the `agent-csr.pem` file to their +The customer must supply the `agent-csr.pem` file to their certificate authority to create a signed file. ::: -**Step 3 –** Copy the `agent-crt.pem` file created and signed by the customer's certificate -authority to the CertsInfo folder on the machine where the Agent is deployed: +**Step 3 –** Copy the `agent-crt.pem` file created and signed by the customer's certificate authority to the CertsInfo folder on the machine where the Agent is deployed: `…\Netwrix\Netwrix Threat Prevention\SIWindowsAgent\CertsInfo` diff --git a/docs/threatprevention/8.0/install/agent/manual/manual.md b/docs/threatprevention/8.0/install/agent/manual.md similarity index 91% rename from docs/threatprevention/8.0/install/agent/manual/manual.md rename to docs/threatprevention/8.0/install/agent/manual.md index a86697fa1f..133f07f4bc 100644 --- a/docs/threatprevention/8.0/install/agent/manual/manual.md +++ b/docs/threatprevention/8.0/install/agent/manual.md @@ -6,12 +6,12 @@ sidebar_position: 10 # Manual Agent Deployment -The Threat PreventionAgent must be installed to the appropriate systems for monitoring. See the +You must install the Threat Prevention Agent on the appropriate systems for monitoring. See the [Agent Information](/docs/threatprevention/8.0/install/agent/overview.md) topic for specifics on where to deploy. The Threat Prevention Agent can be deployed through any of the following methods: -- Deploy the Agent to server(s) through the Administration Console – You can deploy the Agent to one +- Deploy the Agent to servers through the Administration Console – You can deploy the Agent to one or multiple servers through the Administration Console :::info @@ -25,12 +25,12 @@ See the [Agents Interface](/docs/threatprevention/8.0/admin/agents/overview.md) [Deploy Agents](/docs/threatprevention/8.0/admin/agents/deploy/overview.md) topic for additional information to deploy the Agent through the Administration Console. -Follow the steps to manually deploy the Agent. +To manually deploy the Agent: :::note Manually deploying the Agent requires an Enrollment Secret, which is a limited-life (1 hour) password generated by the Enterprise Manager. The Agent Installer uses it to ensure that the -Agent is connected to a legitimate Enterprise Manager. Prior to launching the Threat Prevention +Agent is connected to a legitimate Enterprise Manager. Before launching the Threat Prevention Windows Agent Setup wizard, note the values for the enrollment secret and the EM certificate. See the [Enrollment Secret Configuration Window](/docs/threatprevention/8.0/admin/agents/agents-windows/enrollmentsecretconfiguration.md) @@ -66,7 +66,7 @@ location. ![Change Destination Folder Page](/images/threatprevention/8.0/install/agent/changedestination.webp) -> > - Use the Look In field to select the desired installation folder. +> > - Use the Look In field to select the installation folder you want. > > - When the Folder name is as desired, click **OK**. The wizard returns to the Destination Folder > > page. > > - Click **Next**. @@ -136,13 +136,13 @@ product to enable communication with it. the LSASS DLL versions has been modified since the last time the Threat Prevention Windows Agent service was started. - Start Agent Service – This option starts the Threat Prevention Windows Agent service after the - Agent is installed. If the Threat Prevention Windows Agent service is not started during + Agent is installed. If the Threat Prevention Windows Agent service isn't started during installation, the Agent requires a manual start or needs to be started automatically after a server reboot. Until the Agent is started, no activity monitoring or blocking occurs. :::note If **Custom-managed** is selected on the CA Certificate Configuration page, the - **Start Agent Service** checkbox is disabled because Agent installer does not obtain a + **Start Agent Service** checkbox is disabled because Agent installer doesn't obtain a signed certificate from Enterprise Manager in the custom-managed mode. After installing the Agent, you must create and provide certificates signed by your certificate authority. ::: @@ -162,9 +162,9 @@ the same value displayed in the in the Administration Console. :::note -This page is not displayed when "Custom-managed" is selected on the CA Certificate +This page isn't displayed when "Custom-managed" is selected on the CA Certificate Configuration wizard page .It is also not displayed when the Agent is reinstalled on a machine and -the Certsinfo folder was not manually deleted, in which case the original certificates are re-used. +the Certsinfo folder wasn't manually deleted, in which case the original certificates are re-used. The Certsinfo folder is located at: …\Netwrix\Netwrix Threat Prevention\SIWindowsAgent\CertsInfo\ ::: @@ -181,7 +181,7 @@ The Certsinfo folder is located at: …\Netwrix\Netwrix Threat Prevention\SIWind ![Threat Prevention Windows Agent Setup wizard - Select Event Sources page](/images/threatprevention/8.0/install/agent/eventsources.webp) **Step 9 –** On the Select Event Sources page, select the types of events to be monitored by this -Agent. The installer grays out options that are not applicable to the server where the Agent is +Agent. The installer grays out options that aren't applicable to the server where the Agent is being deployed. Click **Next**. - Windows Event Logs – Available for legacy versions. Option should be grayed-out. @@ -195,10 +195,10 @@ being deployed. Click **Next**. and the Threat Prevention for Exchange solutions. Also available as part of the Activity Monitor for Active Directory solution. - Select this component if the system the Agent is being installed on is an Active Directory - domain controller. This option is grayed-out if the target system is not a domain controller. + domain controller. This option is grayed-out if the target system isn't a domain controller. - Exchange Server Monitoring – Available as part of the Threat Prevention for Exchange solution. - Select this component if the system where the Agent is being installed is running the Exchange - Server. This option will be grayed-out if this Agent is not being installed on an Exchange + Server. This option will be grayed-out if this Agent isn't being installed on an Exchange Server. - NetApp Security Event Log – Available for legacy versions. Option should be grayed-out. - Workstation Events – Available for legacy versions. Option should be grayed-out. @@ -215,4 +215,4 @@ Successful page is displayed. If the certificates are managed by Threat Prevention, Agent deployment is completed. If the custom-managed certificate option was selected, see the -[Create Custom Managed Certificates for Each Agent](/docs/threatprevention/8.0/install/agent/manual/customcert.md) topic for additional information. +[Create Custom Managed Certificates for Each Agent](/docs/threatprevention/8.0/install/agent/customcert.md) topic for additional information. diff --git a/docs/threatprevention/8.0/install/agent/manual/_category_.json b/docs/threatprevention/8.0/install/agent/manual/_category_.json deleted file mode 100644 index 6ead0f6f6e..0000000000 --- a/docs/threatprevention/8.0/install/agent/manual/_category_.json +++ /dev/null @@ -1,10 +0,0 @@ -{ - "label": "Manual Agent Deployment", - "position": 10, - "collapsed": true, - "collapsible": true, - "link": { - "type": "doc", - "id": "manual" - } -} \ No newline at end of file diff --git a/docs/threatprevention/8.0/install/migrateemserver.md b/docs/threatprevention/8.0/install/migrateemserver.md index dc2d8beffb..d1ec9a90a9 100644 --- a/docs/threatprevention/8.0/install/migrateemserver.md +++ b/docs/threatprevention/8.0/install/migrateemserver.md @@ -6,11 +6,11 @@ sidebar_position: 100 # Migrate the Enterprise Manager Server -Follow the steps to move the Threat Prevention8.0 Enterprise Manager to a different server when -using default certificates. +To move the Threat Prevention 8.0 Enterprise Manager to a different server when +using default certificates, complete the following steps: :::warning -Do not remove the Enterprise Manager from the current machine until the migration +Don't remove the Enterprise Manager from the current machine until the migration process is complete. ::: @@ -37,7 +37,7 @@ folder. - Em-crt.pem - Em-key.pem -Then, follow these steps to migrate the “secret.dpapi” file (do not copy). +Then, migrate the “secret.dpapi” file (don't copy) as follows: 1. On the original Enterprise Manager machine: “SecretMgr.exe –e myOutFile” @@ -61,7 +61,7 @@ Then, follow these steps to migrate the “secret.dpapi” file (do not copy). **Step 3 –** Start the Threat Prevention Enterprise Manager service on the new machine. **Step 4 –** On the original Enterprise Manager machine, launch the Administration Console and -follow these steps to update the Enterprise Manager info for each Agent. +update the Enterprise Manager info for each Agent as follows: 1. Click **Agents** in the left pane to open the [Agents Interface](/docs/threatprevention/8.0/admin/agents/overview.md). 2. Right-click an Agent in the grid and select **Update Agent Settings**. You can also select @@ -73,11 +73,11 @@ follow these steps to update the Enterprise Manager info for each Agent. Address/Name field and click **Next**. 4. Verify that the update task completes for each Agent successfully. -At this point, the Agents should get displayed in the Administration Console on the new Enterprise +At this point, the Agents should appear in the Administration Console on the new Enterprise Manager machine. :::note -If you cannot use the Administration Console on the original Enterprise Manager machine, +If you can't use the Administration Console on the original Enterprise Manager machine, then on each machine where the Agent is deployed, you can manually edit the “SIWindowsAgent.exe.config” file to update the following entry with the IP address or name of the new Enterprise Manager. @@ -96,7 +96,7 @@ If Netwrix Threat Prevention is configured to use customer supplied certificates recommended that you uninstall, then re-enroll and re-install all Agents with new certificates. This is because customer supplied certificates usually have the FQDN info of the Enterprise Manager and the new Enterprise Manager machine would typically have a different DNS name. See the -[Create Custom Managed Certificates for Each Agent](/docs/threatprevention/8.0/install/agent/manual/customcert.md) topic for additional +[Create Custom Managed Certificates for Each Agent](/docs/threatprevention/8.0/install/agent/customcert.md) topic for additional information. ::: diff --git a/docs/threatprevention/8.0/requirements/ports.md b/docs/threatprevention/8.0/requirements/ports.md index c2d0759d3d..a9d1464aa6 100644 --- a/docs/threatprevention/8.0/requirements/ports.md +++ b/docs/threatprevention/8.0/requirements/ports.md @@ -11,7 +11,7 @@ network requirements. If choosing the Create Windows Firewall Rules option eithe [Application Server Install](/docs/threatprevention/8.0/install/application.md), in step 6 of the [Administration Console Remote Install](/docs/threatprevention/8.0/install/adminconsole.md), on the Set Options page of the [Deploy Agents Wizard](/docs/threatprevention/8.0/admin/agents/deploy/overview.md#deploy-agents-wizard), or in step 7 of a -[Manual Agent Deployment](/docs/threatprevention/8.0/install/agent/manual/manual.md), then Threat Prevention will create the +[Manual Agent Deployment](/docs/threatprevention/8.0/install/agent/manual.md), then Threat Prevention will create the necessary Windows firewall rules. If using a third party firewall, it will be necessary to manually set these. @@ -138,7 +138,7 @@ are required for communication between the Agent server and the Netwrix Activity The Windows firewall rules need to be configured on the Windows server, which require certain inbound rules be created if the scans are running in applet mode. These scans operate over a default -port range, which cannot be specified via an inbound rule. For more information, see the Microsoft +port range, which can't be specified via an inbound rule. For guidance on connecting to WMI on a remote computer, see the Microsoft [Connecting to WMI on a Remote Computer]() article. @@ -202,7 +202,7 @@ Agent server and the target NetApp Data ONTAP 7-Mode device: Activity Monitor. :::note -If either HTTP or HTTPS are not enabled, the FPolicy on the NetApp Data ONTAP 7-Mode +If either HTTP or HTTPS aren't enabled, the FPolicy on the NetApp Data ONTAP 7-Mode device must be configured manually. Also, the External Engine will not reconnect automatically in the case of a server reboot or service restart. ::: @@ -223,7 +223,7 @@ Agent server and the target NetApp Data ONTAP Cluster-Mode device: Activity Monitor. :::note -If either HTTP or HTTPS are not enabled, the FPolicy on the NetApp Data ONTAP 7-Mode +If either HTTP or HTTPS aren't enabled, the FPolicy on the NetApp Data ONTAP 7-Mode device must be configured manually. Also, the External Engine will not reconnect automatically in the case of a server reboot or service restart. ::: @@ -237,7 +237,7 @@ Agent server and the target Panzura device: | Communication Direction | Protocol | Ports | Description | | ------------------------------------------ | ------------- | ----- | ----------------------- | | Activity Agent Server to Panzura | HTTPS | 443 | Panzura API | -| Panzura filers to to Activity Agent Server | AMQP over TCP | 4497 | Panzura Event Reporting | +| Panzura filers to Activity Agent Server | AMQP over TCP | 4497 | Panzura Event Reporting | Protect the port with a username and password. The credentials will be configured in Panzura. diff --git a/docs/threatprevention/8.0/troubleshooting/enterprisemanagercommunication.md b/docs/threatprevention/8.0/troubleshooting/enterprisemanagercommunication.md index 14a628b329..2d2b01e06c 100644 --- a/docs/threatprevention/8.0/troubleshooting/enterprisemanagercommunication.md +++ b/docs/threatprevention/8.0/troubleshooting/enterprisemanagercommunication.md @@ -17,7 +17,7 @@ Agent, the console and Agent will fail to connect to Enterprise Manager. :::note To configure custom managed certificates for the Enterprise Manager and the Agent, see the [Certificate Management Wizard](/docs/threatprevention/8.0/install/certificatemanagementwizard.md) and -[Create Custom Managed Certificates for Each Agent](/docs/threatprevention/8.0/install/agent/manual/customcert.md) topics +[Create Custom Managed Certificates for Each Agent](/docs/threatprevention/8.0/install/agent/customcert.md) topics respectively. ::: @@ -25,11 +25,11 @@ respectively. You must provide the Enterprise Manager server DNS name when you install the following: - Threat Prevention server (see the [Application Server Install](/docs/threatprevention/8.0/install/application.md) topic) -- Threat Prevention Agent (see the [Manual Agent Deployment](/docs/threatprevention/8.0/install/agent/manual/manual.md) topic) +- Threat Prevention Agent (see the [Manual Agent Deployment](/docs/threatprevention/8.0/install/agent/manual.md) topic) - Remote instance of the Administration Console (see the [Administration Console Remote Install](/docs/threatprevention/8.0/install/adminconsole.md) topic) -If you have already installed the above with the IP address of the Enterprise Manager server, you +If you have already installed these components with the IP address of the Enterprise Manager server, you can change it to the DNS name post-install by modifying the following config files: - SIWinConsole.exe.Config @@ -37,7 +37,7 @@ can change it to the DNS name post-install by modifying the following config fil - SIWindowsAgent.exe.config Path: `…\Netwrix\Netwrix Threat Prevention\SIWindowsAgent\SIWindowsAgent.exe.config` -Follow the steps to modify these files. +To modify these files, complete the following steps: **Step 1 –** Open the SIWindowsAgent.exe.config or SIWinConsole.exe.Config file.