Netwrix Auditor. Tips and Tricks: How To Create Custom Active Directory Alerts. Version: /22/2014

Transcription

1 Netwrix Auditor Tips and Tricks: How To Create Custom Active Directory s Version: /22/2014

2 Legal Notice The information in this publication is furnished for information use only, and does not constitute a commitment from Netwrix Corporation of any features or functions, as this publication may describe features or functionality not applicable to the product release or version you are using. Netwrix makes no representations or warranties about the Software beyond what is provided in the License Agreement. Netwrix Corporation assumes no responsibility or liability for the accuracy of the information presented, which is subject to change without notice. If you believe there is an error in this publication, please report it to us in writing. Netwrix is a registered trademark of Netwrix Corporation. The Netwrix logo and all other Netwrix product or service names and slogans are registered trademarks or trademarks of Netwrix Corporation. Active Directory is a trademark of Microsoft Corporation. All other trademarks and registered trademarks are property of their respective owners. Disclaimers This document may contain information regarding the use and installation of non-netwrix products. Please note that this information is provided as a courtesy to assist you. While Netwrix tries to ensure that this information accurately reflects the information provided by the supplier, please refer to the materials provided with any non-netwrix product and contact the supplier for confirmation. Netwrix Corporation assumes no responsibility or liability for incorrect or incomplete information provided about non-netwrix products Netwrix Corporation. All rights reserved. 2/12

3 Table of Contents 1. Real-Time s Overview Identify Correct Attributes Related Documentation 12 3/12

4 1. Real-Time s Overview 1. Real-Time s Overview Netwrix Auditor allows you to get notified immediately about changes made to certain objects. The Real- Time s are ed just after the specified event has been detected. For general information on configuring alerts, refer to Netwrix Auditor Administrator's Guide. This document provides detailed instructions on how to: Identify correct attributes you want to be alerted on Create some commonly-used custom Active Directory alerts: The Organizational Unit Deletion alert The User Account Lockout alert The User Granted VPN Permissions alert This alert will notify you if an Organizational Unit is deleted from your Active Directory domain. This alert will notify you if a user account gets locked out in your Active Directory domain. This alert will notify you if a user inside your Active Directory domain has been granted VPN permissions. 4/12

5 1. Start the New Real-Time wizard: In the Netwrix Auditor console Navigate to Managed Objects your_ Managed_ Object_ name Active Directory, right-click the Real-Time s node and select New Real-Time. In the Managed Object wizard Proceed to the Configure Real-Time s step and click Add. 2. On the Specify Real-Time Name step, specify the alert name, e.g. "OU Deletion", "User Account Lockout" or "User Granted VPN Permissions", and enter alert description (optional). 3. On the Configure Real- Time Filters and Notifications step, specify the alert filters and configure notifications. Click Add in the Filters section to specify a condition that will trigger the alert. 4. Complete the Filter wizard. Depending on the alert you want to create, complete the following fields: Option The OU Deletion The User Account Lockout The User Granted VPN Permissions The General tab Name E.g. "OU Deletion" E.g. User Account Lockout E.g. "User Granted VPN Permissions" Description severity Enter the description for this filter (optional). Critical Normal Normal NOTE: severity level will be displayed in the notification. 5/12

6 NOTE: The picture below corresponds to the User Granted VPN Permissions alert. Option The OU Deletion The User Account Lockout The User Granted VPN Permissions The Change tab Who *\* *\* *\* changed NOTE: The alert will be NOTE: Active Directory is NOTE: This alert will be triggered if an responsible for locking triggered if any OU is deleted by accounts. An account user s VPN any user. used by the system will permissions are be returned as the modified. Who changed parameter. Change type Remove Modify Modify Object Enter the path to the Leave this field empty. Leave this field empty. path Organizational Unit. NOTE: This alert will be triggered by any account lockout in your Active Directory domain. 6/12

7 Option The OU Deletion The User Account Lockout The User Granted VPN Permissions Include child objects Select this option. Select this option. Select this option. NOTE: The picture below corresponds to the User Granted VPN Permissions alert. Option The OU Deletion The User Account Lockout The User Granted VPN Permissions The Attributes tab Object type Object name Leave this field empty. User User Leave this field empty. Leave this field empty. Leave this field empty. Attribute Leave this field empty. lockouttime msnpallowdialin name NOTE: If you cannot locate this attribute in the list, type it in manually. Previous Leave this field empty. Equals Equals 7/12

8 Option The OU Deletion The User Account Lockout The User Granted VPN Permissions value Leave the second entry field Leave the second entry empty. field empty. Current Leave this field empty. Equals Equals value Select User Account Locked Select True from the Out from the second drop- second drop-down list. down list. NOTE: If you cannot locate this value in the list, type it in manually. NOTE: The picture below corresponds to the User Granted VPN Permissions alert. 8/12

9 Click OK to save the changes and close the Attribute Filters dialog. And OK to save the changes and close the Filter dialog. 5. In the Notifications section of the New Real-Time wizard, click Add and select . Specify the address where notifications will be delivered. You can add as many recipients as necessary. NOTE: It is recommended to click Verify. The system will send a test message to the specified address and inform you if any problems are detected. 6. Review your Real-Time settings and click Finish to exit the wizard. The new alert will be created under the Real-Time s node and triggered if a specified change is detected. Now, if a specified event is detected in your IT infrastructure, an notification will be sent the recipients. For example, if an Organizational Unit is deleted from your Active Directory domain, the following will be sent: 9/12

10 10/12

11 3. Identify Correct Attributes 3. Identify Correct Attributes 1. On the domain controller, make a test change that you want to configure a Real-Time for and that will act as a trigger. 2. In the Netwrix Auditor console, navigate to Managed Objects your_managed_object_name and click Run in the right pane. On data collection completion, you will receive a Change Summary containing a list of changes that have been detected. 3. In this , look for the parameter name in the Details column of the corresponding change. 4. Open the propnames.txt file located in the %Netwrix Auditor installation folder%\active Directory Auditing folder and search for this parameter name. The value corresponding to this parameter is the name of the attribute you are looking for. NOTE: If you are unable to locate the parameter name in the propnames.txt file, that means that the Change Summary contains the internal AD name for this attribute instead of a friendly name. In this case, this is the name of the attribute you are looking for that must be specified in the Attribute Filters dialog. For example, if you want to create an alert that is triggered by modifications of a user s Dial-in/VPN permissions, and you are unsure which attribute is responsible for this change, do the following: 1. On the domain controller, navigate to Start Administrative Tools Active Directory Users and Computers. 2. Expand the domain node and select Users. 3. Right-click a user and select Properties from the pop-up menu. 4. In the Dial-in tab, select Allow access in the Network Access Permission section. 5. In the Netwrix Auditor console, navigate to Managed Objects your_managed_object_name and click Run in the right pane. On data collection completion, you will receive a Change Summary containing the change you have made. 6. In the Details column, locate the change parameter: Allow Dial-in. 7. Open the propnames.txt file and search for this parameter name. The entry in this file must say: *.msnpallowdialin=allow Dial-In. msnpallowdialin is the name of the attribute that must be selected from the drop-down list in the Attribute Filters dialog when creating the alert. 11/12

12 4. Related Documentation 4. Related Documentation The table below lists all documents available to support Netwrix Auditor: Document Netwrix Auditor Installation and Configuration Guide Netwrix Auditor Administrator's Guide Netwrix Auditor Release Notes Description Provides detailed instructions on how to install Netwrix Auditor, and explains how to configure your environment for auditing. Provides a detailed explanation of the Netwrix Auditor features and step-by-step instructions on how to configure and use the product. Contains a list of the known issues that customers may experience with Netwrix Auditor 6.5, and suggests workarounds for these issues. 12/12