Netwrix Auditor Installation and Configuration Guide
Total Page:16
File Type:pdf, Size:1020Kb
Netwrix Auditor Installation and Configuration Guide Version: 10 9/14/2021 Legal Notice The information in this publication is furnished for information use only, and does not constitute a commitment from Netwrix Corporation of any features or functions, as this publication may describe features or functionality not applicable to the product release or version you are using. Netwrix makes no representations or warranties about the Software beyond what is provided in the License Agreement. Netwrix Corporation assumes no responsibility or liability for the accuracy of the information presented, which is subject to change without notice. If you believe there is an error in this publication, please report it to us in writing. Netwrix is a registered trademark of Netwrix Corporation. The Netwrix logo and all other Netwrix product or service names and slogans are registered trademarks or trademarks of Netwrix Corporation. Microsoft, Active Directory, Exchange, Exchange Online, Office 365, SharePoint, SQL Server, Windows, and Windows Server are either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries. All other trademarks and registered trademarks are property of their respective owners. Disclaimers This document may contain information regarding the use and installation of non-Netwrix products. Please note that this information is provided as a courtesy to assist you. While Netwrix tries to ensure that this information accurately reflects the information provided by the supplier, please refer to the materials provided with any non-Netwrix product and contact the supplier for confirmation. Netwrix Corporation assumes no responsibility or liability for incorrect or incomplete information provided about non-Netwrix products. © 2021 Netwrix Corporation. All rights reserved. 2/314 Table of Contents 1. Introduction 11 1.1. Netwrix Auditor Features and Benefits 11 1.2. How It Works 14 1.2.1. Workflow Stages 15 2. Deployment Planning 16 2.1. Netwrix Auditor Server and Client 16 2.1.1. Physical or Virtual? 16 2.1.2. Domains and Trusts 17 2.1.3. Simple Deployment 18 2.1.4. Distributed Deployment (Client-Server) 19 2.2. SQL Server and Databases 19 2.2.1. Databases 19 2.2.2. SQL Server 20 2.2.3. SQL Server Reporting Services 21 2.2.4. Database Sizing 22 2.2.5. Database Settings 22 2.2.5.1. Database Retention 23 2.3. File-Based Repository for Long-Term Archive 24 2.3.1. Location 24 2.3.2. Retention 25 2.3.3. Capacity 26 2.4. Working Folder 26 2.5. Sample Deployment Scenarios 27 2.5.1. Small Environment 27 2.5.1.1. PoC and Production Infrastructure 28 2.5.2. Regular Environment 28 2.5.3. Large Environment 29 2.5.4. Extra-Large Environment 30 3. Prerequisites and System Requirements 33 3/314 3.1. Supported Data Sources 33 3.1.1. Considerations for Oracle Database Auditing 40 3.1.2. Technology Integrations 41 3.2. Requirements to Install Netwrix Auditor 42 3.2.1. Hardware Requirements 42 3.2.1.1. Full Installation 42 3.2.1.2. Client Installation 44 3.2.2. Software Requirements 44 3.2.2.1. Other Components 45 3.2.2.2. Using SSRS-based Reports 48 3.3. Requirements for SQL Server to Store Audit Data 48 4. Protocols and Ports Required for Netwrix Auditor Server 50 5. Install Netwrix Auditor 52 5.1. Install the Product 52 5.2. Installing Core Services to Audit User Activity and SharePoint (Optional) 54 5.2.1. Install Netwrix Auditor for SharePoint Core Service 54 5.2.2. Install Netwrix Auditor User Activity Core Service 55 5.3. Installing Netwrix Auditor Client via Group Policy 56 5.3.1. Extract MSI File 56 5.3.2. Create and Distribute Installation Package 56 5.3.3. Create a Group Policy to Deploy Netwrix Auditor 56 5.4. Install Netwrix Auditor in Silent Mode 59 6. Upgrade to the Latest Version 60 6.1. Before Starting the Upgrade 60 6.1.1. Take Preparatory Steps 60 6.1.2. General Considerations and Known Issues 61 6.2. Upgrade Procedure 62 7. Configure IT Infrastructure for Auditing and Monitoring 63 7.1. Configure Active Directory Domain for Monitoring 77 7.1.1. Domain Audit Policy Settings 77 7.1.2. Audit Settings for AD Partitions 77 7.1.2.1. Domain Partition 77 4/314 7.1.2.2. Configuration and Schema Partitions 77 7.1.3. Security Event Log Settings 78 7.1.4. Exchange Settings 78 7.1.4.1. Next Steps 79 7.1.5. Active Directory: automatic configuration 79 7.1.6. Active Directory: manual configuration 80 7.1.6.1. Configure Basic Domain Audit Policies 81 7.1.6.2. Configure Advanced Audit Policies 82 7.1.6.3. Configure Object-Level Auditing 84 7.1.6.4. Adjust Security Event Log Size and Retention Settings 90 7.1.6.5. Adjust Active Directory Tombstone Lifetime (optional) 91 7.1.6.6. Enable Secondary Logon Service 93 7.2. Configure AD FS Server for Monitoring 93 7.3. Configure Infrastructure for Monitoring Exchange 96 7.3.1. Configure Exchange Administrator Audit Logging Settings 96 7.3.2. Configure Exchange for Monitoring Mailbox Access 98 7.4. Configure Infrastructure for Monitoring Exchange Online 100 7.4.1. Settings for non-owner mailbox access audit: automatic configuration 100 7.4.2. Settings for non-owner mailbox access audit: manual configuration 103 7.5. Prepare for Windows File Server Monitoring 104 7.5.1. Step 1. Check requirements 104 7.5.2. Step 2. Decide on audit data to collect 104 7.5.3. Step 3. Review considerations and limitations 105 7.5.3.1. DFS-related constraints 105 7.5.4. Step 4. Apply required audit settings 106 7.5.5. Step 5. Configure Data Collecting Account 107 7.5.6. Step 6. Configure required protocols and ports 107 7.5.7. File Servers and Antivirus 107 7.5.8. Configure Object-Level Access Auditing 107 7.5.9. Configure Local Audit Policies 118 7.5.10. Configure Advanced Audit Policies 119 7.5.11. Configure Event Log Size and Retention Settings 122 5/314 7.5.12. Enable Remote Registry Service 124 7.5.13. Configure Windows Firewall Inbound Connection Rules 125 7.6. Configure Dell EMC VNX/VNXe/Celerra/Unity for Monitoring 125 7.6.1. Configure Security Event Log Maximum Size 126 7.6.2. Configure Audit Object Access Policy 127 7.6.3. Configure Audit Settings for CIFS File Shares on EMC VNX/VNXe/Unity 128 7.7. Configure EMC Isilon for Monitoring 138 7.7.1. Configure EMC Isilon in Normal and Enterprise Modes 139 7.7.1.1. Considerations and Recommendations 141 7.7.2. Configure EMC Isilon in Compliance Mode 141 7.8. Configure NetApp Filer for Monitoring 144 7.8.1. Configure NetApp Data ONTAP 7 and 8 in 7-mode for Monitoring 144 7.8.1.1. Prerequisites 145 7.8.1.2. Configure Qtree Security 145 7.8.1.3. Configure Admin Web Access 145 7.8.1.4. Configure Event Categories 146 7.8.2. Configure NetApp Clustered Data ONTAP 8 and ONTAP 9 for Monitoring 148 7.8.2.1. Prerequisites 149 7.8.2.2. Configure ONTAPI Web Access 149 7.8.2.3. Configure Firewall Policy 150 7.8.2.4. Configure Event Categories and Log 152 7.8.3. Configure Audit Settings for CIFS File Shares 156 7.9. Configure Nutanix File Server for Monitoring 166 7.9.1. Create User Account to Access Nutanix REST API 167 7.9.2. Configure Partner Server 168 7.9.3. Create a Notification Policy 171 7.9.3.1. Monitored Operations 171 7.9.3.2. Configuration Procedure 171 7.9.3.3. Auditing Specific Folders 173 7.9.3.4. Example 173 7.9.4. Open Port for Inbound Connections 175 7.10. Configure Network Devices for Monitoring 175 6/314 7.10.1. Configure Cisco ASA Devices 176 7.10.2. Configure Cisco IOS 176 7.10.3. Configure Cisco Meraki Devices 178 7.10.4. Configure Fortinet FortiGate Devices 179 7.10.5. Configure Juniper Devices 180 7.10.6. Configure PaloAlto Devices 181 7.10.7. Configure SonicWall Devices 182 7.10.8. Configure HPE Aruba Devices 184 7.10.9. 187 7.10.10. Configure Pulse Secure Devices 187 7.11. Configure Oracle Database for Monitoring 189 7.11.1. Configure Oracle Database 12c, 18c, 19c for Auditing 190 7.11.2. Configure Oracle Database 11g for Auditing 193 7.11.2.1. Select audit trail to store Oracle audit records 194 7.11.2.2. Enable auditing of Oracle Database changes 195 7.11.3. Migrate to Unified Audit 197 7.11.4. Configure Fine Grained Auditing 199 7.11.5. Verify Your Oracle Database Audit Settings 199 7.11.6. Create and Configure Oracle Wallet 201 7.11.6.1. Create Oracle Wallet 201 7.11.6.2. Install Oracle Instant Client 201 7.11.6.3. Configure Oracle Instant Client for HTTP Proxy Connections 202 7.11.6.4. Update Existing Oracle Client Installation 203 7.12. Configure SharePoint Farm for Monitoring 203 7.12.1. Configure Audit Log Trimming 204 7.12.2. Configure Events Auditing Settings 205 7.12.3. Enable SharePoint Administration Service 205 7.13. Configure SQL Server for Monitoring 205 7.13.1. Configuring trace logging 205 7.13.2. Checking for primary key 207 7.13.3. Next steps 207 7.14. Configure Windows Server for Monitoring 207 7/314 7.14.1.