Skip to content

Commit c0bce0d

Browse files
farzanajafarfarzanajafar
committed
Reviewing tables in NTM 3.0. Left with tables on the Predefined Investigation page
1 parent 25dd257 commit c0bce0d

File tree

14 files changed

+72
-115
lines changed

14 files changed

+72
-115
lines changed

‎docs/threatmanager/3.0/administration/configuration/threatdetection/threatconfiguration.md‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ The Processing tab contains the configuration options for processing the threat.
2020

2121
![This screenshot displays the Processing tab.](/img/product_docs/threatmanager/3.0/administration/configuration/processingtab.webp)
2222

23-
General:
23+
**General:**
2424

2525
- Status – When set to ON, this threat will be detected by Threat Manager. When set to OFF, this
2626
threat will not be detected by Threat Manager. When a threat status is **OFF**and then set to
@@ -45,7 +45,7 @@ General:
4545
- Informational – Indicates first-time client use or first-time host use, which can be common
4646
events but may also indicate a threat
4747

48-
Threat Response:
48+
**Threat Response:**
4949

5050
Assigning a threat response designates a playbook to automatically be executed immediately when a
5151
threat of this type is detected.
@@ -56,7 +56,7 @@ threat of this type is detected.
5656
detected. Select Off to turn off forwarding threat information to a SIEM service.
5757
- Run Playbook – Select the playbook that will be used to respond to the threat.
5858

59-
Rollup:
59+
**Rollup:**
6060

6161
**NOTE:** Rollup is not available for all threat types.
6262

‎docs/threatmanager/3.0/administration/investigations/auditcompliance.md‎

Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -27,19 +27,19 @@ Every report generated by an investigation query displays the same type of infor
2727

2828
By default, this folder contains the following saved investigations:
2929

30-
| Investigation | Description | Filters |
31-
| -------------------------------------- | ------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
32-
| AD Changes | All Active Directory changes | One filter statement set: - Attribute = Event Operation - Operator = Equals - Filter = Active Directory Change |
33-
| AD Changes by Domain Admins | All Active Directory changes by Domain Admins | Two filter statements set: - Attribute 1 = Event Operation - Operator 1 = Equals - Filter 1 = Active Directory Change AND - Attribute 2 = Tag (Effective) - Operator 2 = Equals - Filter 2 = Domain Admin |
34-
| AD Logins | Active Directory logins including Kerberos and NTLM authentication | One filter statement set: - Attribute = Event Operation - Operator = Equals - Filter = Active Directory Authentication |
35-
| All Events | New Investigation | No filters set |
36-
| Confirmed Compromised Account Activity | Occurs when a Confirmed Compromised Account is being active within an Entra ID tenant | One filter statement set: - Attribute = Tag (Direct) - Operator = Equals - Filter 1 = Confirmed Compromised |
37-
| Failed AD Logins | All failed Active Directory logins including Kerberos and NTLM authentication | Two filter statements set: - Attribute 1 = Event Operation - Operator 1 = Equals - Filter 1 = Active Directory Authentication AND - Attribute 2 = Success - Operator 2 = Equals - Filter 2 = false |
38-
| Failed Entra ID Logins | Occurs when an Entra ID login attempt has failed | Two filter statements set: - Attribute = Event Operation - Operator = Equals - Filter 1 = EntraID Sign-In And - Attribute = Success - Operator = Equals - Filter 2 = False |
39-
| LDAP Search | All LDAP search events | One filter statement set: - Attribute = Event Operation - Operator = Equals - Filter = LDAP Search |
40-
| Privileged Account Activity | All activity by privileged accounts | One filter statement set: - Attribute = Tag (Direct) - Operator = Equals - Filter = Privileged |
41-
| Risky User Activity | Occurs when a Risky User is being active within an Entra ID tenant | One filter statement set: Attribute = Tag (Direct) Operator = Equals Filter 1 = At Risk |
42-
| Service Account Activity | All activity by service accounts | One filter statement set: - Attribute = Tag (Direct) - Operator = Equals - Filter = Service Account |
43-
| Watchlist User Activity | All activity by watchlist users | One filter statement set: - Attribute = Tag (Effective) - Operator = Equals - Filter = Watchlist |
30+
| Investigation | Description | Filters |
31+
| --- | --- | --- |
32+
| AD Changes | All Active Directory changes | One filter statement set: <br /><ul><li>Attribute = Event Operation</li><li>Operator = Equals</li><li>Filter = Active Directory Change</li></ul> |
33+
| AD Changes by Domain Admins | All Active Directory changes by Domain Admin>s | Two filter statements set: <br /><ul><li> Attribute 1 = Event Operation</li><li>Operator 1 = Equals</li><li>Filter 1 = Active Directory Change <br />AND <br /></li><li>Attribute 2 = Tag (Effective)</li><li>Operator 2 = Equals</li><li>Filter 2 = Domain Admin</li></ul> |
34+
| AD Logins | Active Directory logins including Kerberos and NTLM authentication | One filter statement set: <br /><ul><li> Attribute = Event Operation</li><li>Operator = Equals</li><li>Filter = Active Directory Authentication</li></ul> |
35+
| All Events | New Investigation | No filters set |
36+
| Confirmed Compromised Account Activity | Occurs when a Confirmed Compromised Account is being active within an Entra ID tenant | One filter statement set: <br /><ul><li>Attribute = Tag (Direct)</li><li>Operator = Equals</li><li>Filter 1 = Confirmed Compromised</li></ul> |
37+
| Failed AD Logins | All failed Active Directory logins including Kerberos and NTLM authentication | Two filter statements set: <br /><ul><li>Attribute 1 = Event Operation</li><li>Operator 1 = Equals</li><li>Filter 1 = Active Directory Authentication <br />AND <br /></li><li>Attribute 2 = Success</li><li>Operator 2 = Equals</li><li>Filter 2 = false</li></ul> |
38+
| Failed Entra ID Logins | Occurs when an Entra ID login attempt has failed | Two filter statements set: <br /><ul><li>Attribute = Event Operation</li><li>Operator = Equals</li><li>Filter 1 = EntraID Sign-In <br />And <br /></li><li> Attribute = Success</li><li>Operator = Equals</li><li>Filter 2 = False</li></ul> |
39+
| LDAP Search | All LDAP search events | One filter statement set: <br /><ul><li>Attribute = Event Operation</li><li> Operator = Equals</li><li>Filter = LDAP Search</li></ul> |
40+
| Privileged Account Activity | All activity by privileged accounts | One filter statement set: <br /><ul><li>Attribute = Tag (Direct)</li><li>Operator = Equals</li><li>Filter = Privileged</li></ul> |
41+
| Risky User Activity | Occurs when a Risky User is being active within an Entra ID tenant | One filter statement set: <br /><ul><li>Attribute = Tag (Direct)</li><li>Operator = Equals</li><li>Filter 1 = At Risk</li></ul> |
42+
| Service Account Activity | All activity by service accounts | One filter statement set: <br /><ul><li>Attribute = Tag (Direct)</li><li>Operator = Equals</li><li>Filter = Service Account</li></ul> |
43+
| Watchlist User Activity | All activity by watchlist users | One filter statement set: <br /><ul><li>Attribute = Tag (Effective)</li><li>Operator = Equals</li><li>Filter = Watchlist</li></ul> |
4444

4545
You can save additional investigations to this folder.

‎docs/threatmanager/3.0/administration/investigations/favorites.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -30,14 +30,14 @@ pane. Click the investigation there to open it.
3030

3131
There is an empty star icon beside the name of an investigation not identified as a favorite.
3232

33-
![Empty star showing that investigation is not a favorite](/img/product_docs/threatprevention/7.5/reportingmodule/investigations/favoriteselectedtm.webp)
33+
![Empty star showing that investigation is not a favorite](/img/product_docs/threatmanager/3.0/administration/investigations/FavoriteUnselectedTM.webp)
3434

3535
Click the star to add the investigation to your Favorites list.
3636

3737
## Remove an Investigation from Your Favorites
3838

3939
There is a yellow star icon beside the name of an investigation identified as a favorite.
4040

41-
![Favorite investigation star icon selected](/img/product_docs/threatprevention/7.5/reportingmodule/investigations/favoriteselectedtm.webp)
41+
![Favorite investigation star icon selected](/img/product_docs/threatmanager/3.0/administration/investigations/FavoriteSelected.webp)
4242

4343
Click the yellow star to remove the investigation from your Favorites list.

‎docs/threatmanager/3.0/administration/investigations/reports.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -95,7 +95,7 @@ The tab contains two tables:
9595
- Top Perpetrators
9696
- Top Targets
9797

98-
Top Perpetrators Table
98+
**Top Perpetrators Table**
9999

100100
The Top Perpetrators table displays information about the perpetrators associated with the events.
101101

@@ -107,7 +107,7 @@ It contains the following columns:
107107

108108
Click the link to view perpetrator details.
109109

110-
Top Targets Table
110+
**Top Targets Table**
111111

112112
The Top Targets table displays information about targets associated with the events.
113113

‎docs/threatmanager/3.0/install/integration/threatprevention/threatmanagerconfiguration.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ The Netwrix Threat Manager Configuration window is a global setting to enable in
1010
Threat Prevention and Threat Manager. This window is only available to Threat Prevention
1111
administrators.
1212

13-
Threat Manager App Token
13+
**Threat Manager App Token**
1414

1515
The Threat Manager App Token authenticates connection between Threat Prevention and Threat Manager.
1616
This token is generated in Threat Manager:

‎docs/threatmanager/3.0/install/overview.md‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -15,18 +15,18 @@ The Threat Manager installer is packaged with four executable files.
1515

1616
**CAUTION:** The PostgreSQL database must be installed before installing Threat Manager.
1717

18-
Netwrix_Setup.exe
18+
**Netwrix_Setup.exe**
1919

2020
This executable starts a setup launcher containing buttons to install the PostgreSQL database and
2121
the application. The launcher installs these components on the same server. See the installation
2222
details for each components below.
2323

24-
NetwrixPostgreSQL14.exe
24+
**NetwrixPostgreSQL14.exe**
2525

2626
This executable is for installing the PostgreSQL database on a different server from the
2727
application.
2828

29-
NetwrixThreatManager.exe
29+
**NetwrixThreatManager.exe**
3030

3131
This executable is for installing the application and its services:
3232

@@ -48,7 +48,7 @@ The following prerequisites will be installed if they are not present:
4848
- VC++ redist v14.28.29914
4949
- Python v3.10.8x64
5050

51-
NetwrixThreatManager.ActionService.exe
51+
**NetwrixThreatManager.ActionService.exe**
5252

5353
This executable is for installing the Netwrix Threat Manager Action Service on additional servers.
5454

‎docs/threatmanager/3.0/install/upgrade/upgrade.md‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -27,11 +27,11 @@ must be compatible.
2727
Threat Manager, but it is recommended to upgrade it in order to take full advantage of the new
2828
features.
2929

30-
| Netwrix Activity Monitor Version | Compatibility with Threat Manager v3.0 |
31-
| -------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
32-
| 7.1 | Fully compatible for monitoring of: - File System Data - Active Directory Data - Microsoft Entra ID Data Threat Manager also supports file copy event type and file size information. **NOTE:** SharePoint, SharePoint Online, Exchange Online, Linux, and SQL monitoring are not supported |
33-
| 7.0 | Fully compatible for monitoring of: - File System Data - Active Directory Data - Microsoft Entra ID Data Threat Manager also supports file copy event type and file size information. **NOTE:** SharePoint, SharePoint Online, Exchange Online, Linux, and SQL monitoring are not supported. |
34-
| 6.0 | Fully compatible for monitoring of: - File system Data - Active Directory Data Threat Manager also supports file copy event type and file size information. **NOTE:** SharePoint, SharePoint Online, Exchange Online, Microsoft Entra ID, Linux, and SQL monitoring are not supported |
30+
| Netwrix Activity Monitor Version | Compatibility with Threat Manager v3.0 |
31+
| --- | --- |
32+
| 7.1 | Fully compatible for monitoring of: <br /><ul><li>File System Data</li><li>Active Directory Data</li><li>Microsoft Entra ID Data</li></ul> Threat Manager also supports file copy event type and file size information. <br />**NOTE:** SharePoint, SharePoint Online, Exchange Online, Linux, and SQL monitoring are not supported |
33+
| 7.0 | Fully compatible for monitoring of: <br /><ul><li>File System Data</li><li>Active Directory Data</li><li>Microsoft Entra ID Data</li></ul> Threat Manager also supports file copy event type and file size information. <br />**NOTE:** SharePoint, SharePoint Online, Exchange Online, Linux, and SQL monitoring are not supported. |
34+
| 6.0 | Fully compatible for monitoring of: <br /><ul><li>File system Data</li><li>Active Directory Data</li></ul> Threat Manager also supports file copy event type and file size information. <br />**NOTE:** SharePoint, SharePoint Online, Exchange Online, Microsoft Entra ID, Linux, and SQL monitoring are not supported |
3535

3636
## Threat Manager Services
3737

‎docs/threatmanager/3.0/requirements/actionservice.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,15 +21,15 @@ Additionally the server must meet these requirements:
2121

2222
- US English language installation
2323

24-
RAM, CPU, and Disk Space
24+
**RAM, CPU, and Disk Space**
2525

2626
Minimum hardware requirements:
2727

2828
- 4 GB RAM
2929
- 1 CPU Core
3030
- 500 MB Total Disk Space
3131

32-
Additional Server Requirements
32+
**Additional Server Requirements**
3333

3434
The following are additional requirements for the application server:
3535

‎docs/threatmanager/3.0/requirements/database.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ Additionally the server must meet these requirements:
1919

2020
- US English language installation
2121

22-
Additional Server Requirements
22+
**Additional Server Requirements**
2323

2424
The following are additional requirements for the database server:
2525

@@ -28,7 +28,7 @@ The following are additional requirements for the database server:
2828
- ASP.NET Core 8.0.11
2929
- VC++ redist v14.28.29914
3030

31-
Additional Considerations
31+
**Additional Considerations**
3232

3333
The following considerations must be accommodated for:
3434

‎docs/threatmanager/3.0/requirements/overview.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ exceptions are covered.
1515

1616
The following servers are required for installation of the application:
1717

18-
Core Component
18+
**Core Component**
1919

2020
- Threat Manager Database Server – This is where the Threat Manager PostgreSQL database is
2121
installed.
@@ -34,7 +34,7 @@ See the following topics for server requirements:
3434
- [Client Requirements](/docs/threatmanager/3.0/requirements/client.md)
3535
- [Ports Requirements](/docs/threatmanager/3.0/requirements/ports.md)
3636

37-
Target Environment Considerations
37+
**Target Environment Considerations**
3838

3939
The target environment encompasses all servers, devices, or infrastructure being monitored by
4040
Netwrix Threat Prevention or Netwrix Activity Monitor in addition to data collected by Netwrix

0 commit comments

Comments
 (0)