diff --git a/docs/auditor/10.7/configuration/networkdevices/ciscoasa.md b/docs/auditor/10.7/configuration/networkdevices/ciscoasa.md index 541311a546..31cc07277d 100644 --- a/docs/auditor/10.7/configuration/networkdevices/ciscoasa.md +++ b/docs/auditor/10.7/configuration/networkdevices/ciscoasa.md @@ -6,37 +6,27 @@ sidebar_position: 20 # Configure Cisco ASA Devices -Netwrix Auditor relies on native logs for collecting audit data. Therefore, successful change and -access auditing requires a certain configuration of native audit settings in the audited environment -and on the Auditor console computer. Configuring your IT infrastructure may also include enabling -certain built-in Windows services, etc. Proper audit configuration is required to ensure audit data -integrity, otherwise your change reports may contain warnings, errors or incomplete audit data. - -**CAUTION:** Folder associated with Netwrix Auditor must be excluded from antivirus scanning. See -the +Netwrix Auditor relies on native syslog events for collecting audit data. Therefore, successful +change and access auditing requires a certain configuration of native audit settings in the audited +environment. Proper audit configuration ensures audit data integrity; otherwise, your change reports +may contain warnings, errors, or incomplete audit data. + +**CAUTION:** Exclude the folder associated with Netwrix Auditor from antivirus scanning. See the [Antivirus Exclusions for Netwrix Auditor](/docs/kb/auditor/system-administration/security-hardening/antivirus-exclusions-for-netwrix-auditor) knowledge base article for additional information. -You can configure your IT Infrastructure for monitoring in one of the following ways: - -- Automatically through a monitoring plan – This is a recommended method. If you select to - automatically configure audit in the target environment, your current audit settings will be - checked on each data collection and adjusted if necessary. -- Manually – Native audit settings must be adjusted manually to ensure collecting comprehensive and - reliable audit data. You can enable Auditor to continually enforce the relevant audit policies or - configure them manually: +Netwrix Auditor can't push configuration changes to network devices, so configure native audit +settings manually on the Cisco ASA device. When you finish, the device has the following settings: - - On the Cisco ASA Device: +- The global configuration mode is enabled. +- The `logging enable` option is turned on. +- The `logging host` parameter is set to the host address of the audited Cisco ASA device, and the + device uses a UDP port (for example, 514) to send messages. - - The global configuration mode is selected. - - The `logging enable `option is selected on the Cisco ASA device. - - The `logging host` parameter is set to the host address of the audited CiscoASA device. - And UDP port (for, example 514) is used for sending messages. + **NOTE:** Don't select the EMBLEM format logging for the syslog server option. - **NOTE:** Do not select the EMBLEM format logging for the syslog server option. - - - The `logging timestamp` option enabled. - - The `logging trap` option is selected from 1 to 6 inclusive. +- The `logging timestamp` option is enabled. +- The `logging trap` option is set from 1 to 6 inclusive. To configure your Cisco ASA devices, do the following: @@ -53,13 +43,11 @@ To configure your Cisco ASA devices, do the following: hostname(config)# logging enable 4. Set the IP address of the computer that hosts Netwrix Auditor Server as the `logging host` - parameter. And make sure that the UDP port is used for sending syslog messages (e.g., 514 UDP + parameter, and ensure that the device uses a UDP port to send syslog messages (e.g., 514 UDP port). For example: hostname(config)# logging host `` - Do not select the EMBLEM format logging for the syslog server option. - 5. Enable the `logging timestamp` option. For example: hostname(config)# logging timestamp diff --git a/docs/auditor/10.7/configuration/networkdevices/ciscoios.md b/docs/auditor/10.7/configuration/networkdevices/ciscoios.md index b4f9448cd2..94b90a85d5 100644 --- a/docs/auditor/10.7/configuration/networkdevices/ciscoios.md +++ b/docs/auditor/10.7/configuration/networkdevices/ciscoios.md @@ -6,31 +6,23 @@ sidebar_position: 30 # Configure Cisco IOS Devices -Netwrix Auditor relies on native logs for collecting audit data. Therefore, successful change and -access auditing requires a certain configuration of native audit settings in the audited environment -and on the Auditor console computer. Configuring your IT infrastructure may also include enabling -certain built-in Windows services, etc. Proper audit configuration is required to ensure audit data -integrity, otherwise your change reports may contain warnings, errors or incomplete audit data. - -**CAUTION:** Folder associated with Netwrix Auditor must be excluded from antivirus scanning. See -the +Netwrix Auditor relies on native syslog events for collecting audit data. Therefore, successful +change and access auditing requires a certain configuration of native audit settings in the audited +environment. Proper audit configuration ensures audit data integrity; otherwise, your change reports +may contain warnings, errors, or incomplete audit data. + +**CAUTION:** Exclude the folder associated with Netwrix Auditor from antivirus scanning. See the [Antivirus Exclusions for Netwrix Auditor](/docs/kb/auditor/system-administration/security-hardening/antivirus-exclusions-for-netwrix-auditor) knowledge base article for additional information. -You can configure your IT Infrastructure for monitoring in one of the following ways: - -- Automatically through a monitoring plan – This is a recommended method. If you select to - automatically configure audit in the target environment, your current audit settings will be - checked on each data collection and adjusted if necessary. -- Manually – Native audit settings must be adjusted manually to ensure collecting comprehensive and - reliable audit data. You can enable Auditor to continually enforce the relevant audit policies or - configure them manually: +Netwrix Auditor can't push configuration changes to network devices, so configure native audit +settings manually on the Cisco IOS device. When you finish, the device has the following settings: - - The global configuration mode is selected. - - The `logging timestamp` option enabled. - - The `logging trap` option is selected from 1 to 6 inclusive. - - The `logging host` parameter is set to the host address where the service is going to be - installed. And UDP port (for, example 514) is used for sending messages. +- The global configuration mode is enabled. +- The `logging timestamp` option is enabled. +- The `logging trap` option is set from 1 to 6 inclusive. +- The `logging host` parameter is set to the host address of the computer that hosts Netwrix + Auditor Server, and the device uses a UDP port (for example, 514) to send messages. To configure your Cisco IOS devices, do the following: @@ -48,8 +40,8 @@ To configure your Cisco IOS devices, do the following: Router# logging trap 5 -5. Set the IP address of the Netwrix Auditor Server as the logging host parameter. And make sure - that the UDP port is used for sending syslog messages (e.g., 514 UDP port). For example: +5. Set the IP address of the Netwrix Auditor Server as the logging host parameter, and ensure that + the device uses a UDP port to send syslog messages (e.g., 514 UDP port). For example: Router# logging 192.168.1.5 diff --git a/docs/auditor/10.7/configuration/networkdevices/fortinetfortigate.md b/docs/auditor/10.7/configuration/networkdevices/fortinetfortigate.md index e2ec396d9b..6866ce6b5c 100644 --- a/docs/auditor/10.7/configuration/networkdevices/fortinetfortigate.md +++ b/docs/auditor/10.7/configuration/networkdevices/fortinetfortigate.md @@ -6,32 +6,21 @@ sidebar_position: 60 # Configure Fortinet FortiGate Devices -Netwrix Auditor relies on native logs for collecting audit data. Therefore, successful change and -access auditing requires a certain configuration of native audit settings in the audited environment -and on the Auditor console computer. Configuring your IT infrastructure may also include enabling -certain built-in Windows services, etc. Proper audit configuration is required to ensure audit data -integrity, otherwise your change reports may contain warnings, errors or incomplete audit data. - -**CAUTION:** Folder associated with Netwrix Auditor must be excluded from antivirus scanning. See -the +Netwrix Auditor relies on native syslog events for collecting audit data. Therefore, successful +change and access auditing requires a certain configuration of native audit settings in the audited +environment. Proper audit configuration ensures audit data integrity; otherwise, your change reports +may contain warnings, errors, or incomplete audit data. + +**CAUTION:** Exclude the folder associated with Netwrix Auditor from antivirus scanning. See the [Antivirus Exclusions for Netwrix Auditor](/docs/kb/auditor/system-administration/security-hardening/antivirus-exclusions-for-netwrix-auditor) knowledge base article for additional information. -You can configure your IT Infrastructure for monitoring in one of the following ways: - -- Automatically through a monitoring plan – This is a recommended method. If you select to - automatically configure audit in the target environment, your current audit settings will be - checked on each data collection and adjusted if necessary. -- Manually – Native audit settings must be adjusted manually to ensure collecting comprehensive and - reliable audit data. You can enable Auditor to continually enforce the relevant audit policies or - configure them manually: - - - The target Fortinet Fortigate device must be configured via Command Line Interface (CLI) as - described below. +Configure native audit settings manually on the Fortinet FortiGate device to ensure Netwrix +Auditor collects comprehensive and reliable audit data. To configure your Fortinet FortiGate devices, enable logging to multiple Syslog servers and -configure FortiOS to send log messages to remote syslog servers in CEF format. Do one of the -following: +configure FortiOS to send log messages to remote syslog servers in Common Event Format (CEF). Do +one of the following: - To configure Fortinet FortiGate devices via Command Line Interface - To configure Fortinet FortiGate devices through the Fortigate Management Console diff --git a/docs/auditor/10.7/configuration/networkdevices/juniper.md b/docs/auditor/10.7/configuration/networkdevices/juniper.md index 42e08c3ee4..7faf4b7b1f 100644 --- a/docs/auditor/10.7/configuration/networkdevices/juniper.md +++ b/docs/auditor/10.7/configuration/networkdevices/juniper.md @@ -6,51 +6,39 @@ sidebar_position: 80 # Configure Juniper Devices -Netwrix Auditor relies on native logs for collecting audit data. Therefore, successful change and -access auditing requires a certain configuration of native audit settings in the audited environment -and on the Auditor console computer. Configuring your IT infrastructure may also include enabling -certain built-in Windows services, etc. Proper audit configuration is required to ensure audit data -integrity, otherwise your change reports may contain warnings, errors or incomplete audit data. - -**CAUTION:** Folder associated with Netwrix Auditor must be excluded from antivirus scanning. See -the +Netwrix Auditor relies on native syslog events for collecting audit data. Therefore, successful +change and access auditing requires a certain configuration of native audit settings in the audited +environment. Proper audit configuration ensures audit data integrity; otherwise, your change reports +may contain warnings, errors, or incomplete audit data. + +**CAUTION:** Exclude the folder associated with Netwrix Auditor from antivirus scanning. See the [Antivirus Exclusions for Netwrix Auditor](/docs/kb/auditor/system-administration/security-hardening/antivirus-exclusions-for-netwrix-auditor) knowledge base article for additional information. -You can configure your IT Infrastructure for monitoring in one of the following ways: - -- Automatically through a monitoring plan – This is a recommended method. If you select to - automatically configure audit in the target environment, your current audit settings will be - checked on each data collection and adjusted if necessary. -- Manually – Native audit settings must be adjusted manually to ensure collecting comprehensive and - reliable audit data. You can enable Auditor to continually enforce the relevant audit policies or - configure them manually: - - - The target Juniper device must be configured via JunOS Command Line Interface (CLI) as - described below. +Configure native audit settings manually on the Juniper device to ensure Netwrix Auditor collects +comprehensive and reliable audit data. -To configure you Juniper devices, do the following: +To configure your Juniper devices, do the following: -1. Launch the JunOS Command Line Interface (CLI). +1. Launch the Junos OS command line interface (CLI). 2. Execute the following commands: # configure # set system syslog host `` any info - where `` is the IP address of the computer where Netwrix Auditor Server is - installed. + where `` is the IP address of the computer that hosts Netwrix Auditor Server. # set system syslog host `` port `` where - `` is the IP address of the computer where Netwrix Auditor Server is installed + `` is the IP address of the computer that hosts Netwrix Auditor Server AND - `` is the name of the UDP port used to listen to network devices (514 port used by - default). [Network Devices](/docs/auditor/10.7/admin/monitoringplans/networkdevices.md) + `` is the name of the UDP port that Netwrix Auditor uses to listen to network + devices (port 514 by default). [Network Devices](/docs/auditor/10.7/admin/monitoringplans/networkdevices.md) # set system syslog time-format `` diff --git a/docs/auditor/10.7/configuration/networkdevices/paloalto.md b/docs/auditor/10.7/configuration/networkdevices/paloalto.md index 4f14fc45d3..76e486862d 100644 --- a/docs/auditor/10.7/configuration/networkdevices/paloalto.md +++ b/docs/auditor/10.7/configuration/networkdevices/paloalto.md @@ -6,33 +6,20 @@ sidebar_position: 90 # Configure PaloAlto Devices -Netwrix Auditor relies on native logs for collecting audit data. Therefore, successful change and -access auditing requires a certain configuration of native audit settings in the audited environment -and on the Auditor console computer. Configuring your IT infrastructure may also include enabling -certain built-in Windows services, etc. Proper audit configuration is required to ensure audit data -integrity, otherwise your change reports may contain warnings, errors or incomplete audit data. - -**CAUTION:** Folder associated with Netwrix Auditor must be excluded from antivirus scanning. See -the +Netwrix Auditor relies on native syslog events for collecting audit data. Therefore, successful +change and access auditing requires a certain configuration of native audit settings in the audited +environment. Proper audit configuration ensures audit data integrity; otherwise, your change reports +may contain warnings, errors, or incomplete audit data. + +**CAUTION:** Exclude the folder associated with Netwrix Auditor from antivirus scanning. See the [Antivirus Exclusions for Netwrix Auditor](/docs/kb/auditor/system-administration/security-hardening/antivirus-exclusions-for-netwrix-auditor) knowledge base article for additional information. -You can configure your IT Infrastructure for monitoring in one of the following ways: - -- Automatically through a monitoring plan – This is a recommended method. If you select to - automatically configure audit in the target environment, your current audit settings will be - checked on each data collection and adjusted if necessary. -- Manually – Native audit settings must be adjusted manually to ensure collecting comprehensive and - reliable audit data. You can enable Auditor to continually enforce the relevant audit policies or - configure them manually: - - - Create a Syslog Server profile and syslog forwarding for the target PaloAlto device via Web - Interface as described below. - -To configure your PaloAlto devices, create a Syslog server profile and assign it to the log settings -for each log type. +Configure native audit settings manually on the Palo Alto device via the web interface to ensure +Netwrix Auditor collects comprehensive and reliable audit data. Create a syslog server profile and +assign it to the log settings for each log type. -Follow the steps to configure a Syslog server profile. +## Configure a syslog server profile **Step 1 –** Connect to your PaloAlto device: launch an Internet browser and enter the IP address of the firewall in the URL field (https://``). @@ -48,23 +35,24 @@ the firewall in the URL field (https://``). | Name | Specify unique name for a syslog server. | | Syslog Server | Provide a server name by entering its FQDN or IPv4 address. | | Transport | Select UDP. | -| Port | Provide the name of the UDP port used to listen to network devices (514 port used by default). | +| Port | Provide the name of the UDP port that Netwrix Auditor uses to listen to network devices (port 514 by default). | | Format | Select IETF. | | Facility | Netwrix recommends using default values. | -Follow the steps to configure syslog forwarding. +## Configure syslog forwarding **Step 1 –** In the Web Interface, navigate to **Device** > **Log Settings**. **Step 2 –** For System, Config, and User ID logs, click Add and enter unique name of your syslog server. -**Step 3 –** On the syslog panel, click Add and select the syslog profile you created above. +**Step 3 –** On the syslog panel, click Add and select the syslog server profile you created in +[Configure a syslog server profile](#configure-a-syslog-server-profile). **Step 4 –** Click **Commit** and review the logs on the syslog server. -**NOTE:** After configuring the monitoring plan, Netwrix Auditor will listen to the logs forwarded -by the Palo Alto device. +**NOTE:** After you configure the monitoring plan, Netwrix Auditor listens to the logs that the +Palo Alto device forwards. ## PaloAlto Devices diff --git a/docs/auditor/10.7/configuration/networkdevices/sonicwall.md b/docs/auditor/10.7/configuration/networkdevices/sonicwall.md index 49d7dc0148..0778713a8d 100644 --- a/docs/auditor/10.7/configuration/networkdevices/sonicwall.md +++ b/docs/auditor/10.7/configuration/networkdevices/sonicwall.md @@ -6,27 +6,17 @@ sidebar_position: 110 # Configure SonicWall Devices -Netwrix Auditor relies on native logs for collecting audit data. Therefore, successful change and -access auditing requires a certain configuration of native audit settings in the audited environment -and on the Auditor console computer. Configuring your IT infrastructure may also include enabling -certain built-in Windows services, etc. Proper audit configuration is required to ensure audit data -integrity, otherwise your change reports may contain warnings, errors or incomplete audit data. - -**CAUTION:** Folder associated with Netwrix Auditor must be excluded from antivirus scanning. See -the +Netwrix Auditor relies on native syslog events for collecting audit data. Therefore, successful +change and access auditing requires a certain configuration of native audit settings in the audited +environment. Proper audit configuration ensures audit data integrity; otherwise, your change reports +may contain warnings, errors, or incomplete audit data. + +**CAUTION:** Exclude the folder associated with Netwrix Auditor from antivirus scanning. See the [Antivirus Exclusions for Netwrix Auditor](/docs/kb/auditor/system-administration/security-hardening/antivirus-exclusions-for-netwrix-auditor) knowledge base article for additional information. -You can configure your IT Infrastructure for monitoring in one of the following ways: - -- Automatically through a monitoring plan – This is a recommended method. If you select to - automatically configure audit in the target environment, your current audit settings will be - checked on each data collection and adjusted if necessary. -- Manually – Native audit settings must be adjusted manually to ensure collecting comprehensive and - reliable audit data. You can enable Auditor to continually enforce the relevant audit policies or - configure them manually: - - - Configure log settings, depending on your device type. +Configure native audit settings manually on the SonicWall device to ensure Netwrix Auditor +collects comprehensive and reliable audit data. Adjust the log settings for your device type. To configure your SonicWall devices, do the following: @@ -43,7 +33,7 @@ To configure SonicWall Web Application Firewall | - Log Level - Alert Level - Syslog Level | Set to "Info". | | - Enable Audit Log - Send to Syslog Server in Audit Log Settings - Send to Syslog Server in Access Log Settings | Select these checkboxes. | | Primary Syslog Server | Enter the address of your Netwrix Auditor Server. | - | Primary Syslog Server Port | Provide the name of the UDP port used to listen to network devices (514 port used by default). | + | Primary Syslog Server Port | Provide the name of the UDP port that Netwrix Auditor uses to listen to network devices (port 514 by default). | 4. Click Accept. 5. Navigate to Log → Categories. @@ -70,7 +60,7 @@ To configure SonicWall SMA | - Log Level - Alert Level - Syslog Level | Set to "Info". | | - Enable Audit Log - Send to Syslog Server in Audit Log Settings - Send to Syslog Server in Access Log Settings | Select these checkboxes. | | Primary Syslog Server | Enter the address of your Netwrix Auditor Server. | - | Primary Syslog Server Port | Provide the name of the UDP port used to listen to network devices (514 port used by default). | + | Primary Syslog Server Port | Provide the name of the UDP port that Netwrix Auditor uses to listen to network devices (port 514 by default). | 4. Click Accept. 5. Navigate to Log → Categories. @@ -96,12 +86,12 @@ To configure SonicWall NS series 6. Navigate to Manage → Log Settings → Syslog. 7. Set the Syslog Format to Default. 8. Click Add. -9. In the dialog appears, select Create new address object option in the Name or IP Address combo - box. +9. In the dialog that appears, select the Create new address object option in the Name or IP + Address combo box. 10. Provide name and IP address of the new object. 11. Click OK. -12. In the Add Syslog Server dialog, find the IP address you specified on the step 10 in the Name or - IP Address list. +12. In the Add Syslog Server dialog, in the Name or IP Address list, find the IP address you + specified in step 10. 13. Click OK. 14. Click Save. @@ -112,16 +102,16 @@ Review a full list of object types Netwrix Auditor can collect on SonicWall netw | Object type | Actions | Event ID | | ------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Logon | - Successful logon | - User login from an internal zone allowed - User login successful - XAUTH Succeeded with VPN - VPN zone remote user login allowed - WAN zone remote user login allowed - PPP: Authentication successful - Local Authentication Success - RADIUS/LDAP Authentication Success - Successful authentication received for Remotely Triggered - IKEv2 Authentication successful - SSL VPN zone remote user login allowed | -| - Failed logon | - User login denied - User login failed - XAUTH Failed with VPN - L2TP PPP Authentication Failed - check username / password - RADIUS/LDAP reports Authentication Failure - Local Authentication Failure - User login to Administration Portal denied - User login failure rate exceeded - User Name authentication Failure locally - ISAKMP_AUTH_FAILED - Guest service limit reached - Guest login denied - Incorrect authentication received for Remotely Triggered - Authentication Timeout during Remotely Triggered - Problem occurred during user group membership retrieval - An error has occurred while sending your - IPsec Authentication Failed | | +| - Failed logon | - User login denied - User login failed - XAUTH Failed with VPN - L2TP PPP Authentication Failed - check username / password - RADIUS/LDAP reports Authentication Failure - Local Authentication Failure - User log in to Administration Portal denied - User login failure rate exceeded - User Name authentication Failure locally - ISAKMP_AUTH_FAILED - Guest service limit reached - Guest login denied - Incorrect authentication received for Remotely Triggered - Authentication Timeout during Remotely Triggered - Problem occurred during user group membership retrieval - An error has occurred while sending your - IPsec Authentication Failed | | | - Logoff | - User logged out - logged out - Guest Session Timeout - Guest Account Timeout - Guest Idle Timeout - Guest traffic quota exceeded | | | Authentication | - Successful Logon | - Administrator login allowed - CLI administrator login allowed - VPN zone administrator login allowed - WAN zone administrator login allowed - Configuration mode administration session started - Read-only mode GUI administration session started - Non-config mode GUI administration session started - User login successful - Session Start: - EventMessage: Session Start Success | -| - Failed Logon | - Administrator login denied - CLI administrator login denied due to bad credentials - User login failed - The account has been disabled for - is not permitted for this Web App - Authentication for user - Authentication failed - maximum authentication attempts exceeded for - EventMessage: Session Start Failed | | +| - Failed Logon | - Administrator login denied - CLI administrator login denied due to bad credentials - User login failed - The account has been disabled for - isn't permitted for this Web App - Authentication for user - Authentication failed - maximum authentication attempts exceeded for - EventMessage: Session Start Failed | | | - Logoff | - Administrator logged out - CLI administrator logged out - Configuration mode administration session ended - GUI administration session ended - Logged out - Session End: - EventMessage: Session End - Command='Tunnel' | | | Configuration | - Add / Added (Failed attempt) | - m=1333 - Scheduled settings generated - A new default Self-Signed certificate was generated successfully - Scheduled Tech Support Report generated - Restarted Tech Support Report generated | | - Modified / Modify (Failed attempt) | - Mail attachment disabled - Watch and report possible SYN floods - Watch and proxy WAN connections when under attack - Always proxy WAN connections - SYN Flood blacklisting enabled by user - SYN Flood blacklisting disabled by user - Administrator name changed - VPN disabled by administrator - VPN enabled by administrator - WLAN disabled by administrator - WLAN enabled by administrator - WLAN disabled by schedule - WLAN enabled by schedule - is added into Group - is removed from Group - m=1334 - Update administrator/user lockout params - Settings imported - Critical Operating System Update failed - msg=\"WAF restarted - HTTP(S) Cache settings were updated - database has been updated - Web Server Fingerprint Protection enforced - About to reconfigure service: - Finished applying configuration changes - Started - Start failed - Stopped | | -| - Read / Read (Failed attempt) | - m=1203 - m=1204 - Problem loading the URL list - Registration Update Needed, Please restore your existing security service subscriptions - Failed to synchronize license information with Licensing Server - Current settings exported - Error sending - settings sent successfully - Automated scheduled settings successful - Scheduled settings downloaded - Tech Support Report - Tech Support Report sent successfully - Loaded WAF signature database successfully - Error sending - logs sent out successfully | | +| - Read / Read (Failed attempt) | - m=1203 - m=1204 - Problem loading the URL list - Registration Update Needed, restore your existing security service subscriptions - Failed to synchronize license information with Licensing Server - Current settings exported - Error sending - settings sent successfully - Automated scheduled settings successful - Scheduled settings downloaded - Tech Support Report - Tech Support Report sent successfully - Loaded WAF signature database successfully - Error sending - logs sent out successfully | | | | - Remove / Removed (Failed attempt) | - Scheduled settings deleted - Oldest scheduled Tech Support Report deleted - has been deleted - Event Logs cleared - Audit Logs cleared - Access Logs cleared - Deleting log files - Deleting core files - Deleting snapshots older | -| Device state | - Modified / Modify (Failed attempt) | - Registration Update Needed, Please restore your existing security service subscriptions - Intrusion Prevention (IDP) subscription has expired - Failed to synchronize license information with Licensing Server | +| Device state | - Modified / Modify (Failed attempt) | - Registration Update Needed, restore your existing security service subscriptions - Intrusion Prevention (IDP) subscription has expired - Failed to synchronize license information with Licensing Server | | Folder | - Add / Added (Failed attempt) | - Request='GET /cgi-bin/sonicfiles?RacNumber=9&Arg1= | | - Read / Read (Failed attempt) | - Request='GET /cgi-bin/sonicfiles?RacNumber=16&Arg1= | | | - Remove / Removed (Failed attempt) | - Request='GET /cgi-bin/sonicfiles?RacNumber=13&Arg1= | | diff --git a/docs/auditor/10.8/configuration/networkdevices/ciscoasa.md b/docs/auditor/10.8/configuration/networkdevices/ciscoasa.md index 541311a546..31cc07277d 100644 --- a/docs/auditor/10.8/configuration/networkdevices/ciscoasa.md +++ b/docs/auditor/10.8/configuration/networkdevices/ciscoasa.md @@ -6,37 +6,27 @@ sidebar_position: 20 # Configure Cisco ASA Devices -Netwrix Auditor relies on native logs for collecting audit data. Therefore, successful change and -access auditing requires a certain configuration of native audit settings in the audited environment -and on the Auditor console computer. Configuring your IT infrastructure may also include enabling -certain built-in Windows services, etc. Proper audit configuration is required to ensure audit data -integrity, otherwise your change reports may contain warnings, errors or incomplete audit data. - -**CAUTION:** Folder associated with Netwrix Auditor must be excluded from antivirus scanning. See -the +Netwrix Auditor relies on native syslog events for collecting audit data. Therefore, successful +change and access auditing requires a certain configuration of native audit settings in the audited +environment. Proper audit configuration ensures audit data integrity; otherwise, your change reports +may contain warnings, errors, or incomplete audit data. + +**CAUTION:** Exclude the folder associated with Netwrix Auditor from antivirus scanning. See the [Antivirus Exclusions for Netwrix Auditor](/docs/kb/auditor/system-administration/security-hardening/antivirus-exclusions-for-netwrix-auditor) knowledge base article for additional information. -You can configure your IT Infrastructure for monitoring in one of the following ways: - -- Automatically through a monitoring plan – This is a recommended method. If you select to - automatically configure audit in the target environment, your current audit settings will be - checked on each data collection and adjusted if necessary. -- Manually – Native audit settings must be adjusted manually to ensure collecting comprehensive and - reliable audit data. You can enable Auditor to continually enforce the relevant audit policies or - configure them manually: +Netwrix Auditor can't push configuration changes to network devices, so configure native audit +settings manually on the Cisco ASA device. When you finish, the device has the following settings: - - On the Cisco ASA Device: +- The global configuration mode is enabled. +- The `logging enable` option is turned on. +- The `logging host` parameter is set to the host address of the audited Cisco ASA device, and the + device uses a UDP port (for example, 514) to send messages. - - The global configuration mode is selected. - - The `logging enable `option is selected on the Cisco ASA device. - - The `logging host` parameter is set to the host address of the audited CiscoASA device. - And UDP port (for, example 514) is used for sending messages. + **NOTE:** Don't select the EMBLEM format logging for the syslog server option. - **NOTE:** Do not select the EMBLEM format logging for the syslog server option. - - - The `logging timestamp` option enabled. - - The `logging trap` option is selected from 1 to 6 inclusive. +- The `logging timestamp` option is enabled. +- The `logging trap` option is set from 1 to 6 inclusive. To configure your Cisco ASA devices, do the following: @@ -53,13 +43,11 @@ To configure your Cisco ASA devices, do the following: hostname(config)# logging enable 4. Set the IP address of the computer that hosts Netwrix Auditor Server as the `logging host` - parameter. And make sure that the UDP port is used for sending syslog messages (e.g., 514 UDP + parameter, and ensure that the device uses a UDP port to send syslog messages (e.g., 514 UDP port). For example: hostname(config)# logging host `` - Do not select the EMBLEM format logging for the syslog server option. - 5. Enable the `logging timestamp` option. For example: hostname(config)# logging timestamp diff --git a/docs/auditor/10.8/configuration/networkdevices/ciscoios.md b/docs/auditor/10.8/configuration/networkdevices/ciscoios.md index b4f9448cd2..94b90a85d5 100644 --- a/docs/auditor/10.8/configuration/networkdevices/ciscoios.md +++ b/docs/auditor/10.8/configuration/networkdevices/ciscoios.md @@ -6,31 +6,23 @@ sidebar_position: 30 # Configure Cisco IOS Devices -Netwrix Auditor relies on native logs for collecting audit data. Therefore, successful change and -access auditing requires a certain configuration of native audit settings in the audited environment -and on the Auditor console computer. Configuring your IT infrastructure may also include enabling -certain built-in Windows services, etc. Proper audit configuration is required to ensure audit data -integrity, otherwise your change reports may contain warnings, errors or incomplete audit data. - -**CAUTION:** Folder associated with Netwrix Auditor must be excluded from antivirus scanning. See -the +Netwrix Auditor relies on native syslog events for collecting audit data. Therefore, successful +change and access auditing requires a certain configuration of native audit settings in the audited +environment. Proper audit configuration ensures audit data integrity; otherwise, your change reports +may contain warnings, errors, or incomplete audit data. + +**CAUTION:** Exclude the folder associated with Netwrix Auditor from antivirus scanning. See the [Antivirus Exclusions for Netwrix Auditor](/docs/kb/auditor/system-administration/security-hardening/antivirus-exclusions-for-netwrix-auditor) knowledge base article for additional information. -You can configure your IT Infrastructure for monitoring in one of the following ways: - -- Automatically through a monitoring plan – This is a recommended method. If you select to - automatically configure audit in the target environment, your current audit settings will be - checked on each data collection and adjusted if necessary. -- Manually – Native audit settings must be adjusted manually to ensure collecting comprehensive and - reliable audit data. You can enable Auditor to continually enforce the relevant audit policies or - configure them manually: +Netwrix Auditor can't push configuration changes to network devices, so configure native audit +settings manually on the Cisco IOS device. When you finish, the device has the following settings: - - The global configuration mode is selected. - - The `logging timestamp` option enabled. - - The `logging trap` option is selected from 1 to 6 inclusive. - - The `logging host` parameter is set to the host address where the service is going to be - installed. And UDP port (for, example 514) is used for sending messages. +- The global configuration mode is enabled. +- The `logging timestamp` option is enabled. +- The `logging trap` option is set from 1 to 6 inclusive. +- The `logging host` parameter is set to the host address of the computer that hosts Netwrix + Auditor Server, and the device uses a UDP port (for example, 514) to send messages. To configure your Cisco IOS devices, do the following: @@ -48,8 +40,8 @@ To configure your Cisco IOS devices, do the following: Router# logging trap 5 -5. Set the IP address of the Netwrix Auditor Server as the logging host parameter. And make sure - that the UDP port is used for sending syslog messages (e.g., 514 UDP port). For example: +5. Set the IP address of the Netwrix Auditor Server as the logging host parameter, and ensure that + the device uses a UDP port to send syslog messages (e.g., 514 UDP port). For example: Router# logging 192.168.1.5 diff --git a/docs/auditor/10.8/configuration/networkdevices/fortinetfortigate.md b/docs/auditor/10.8/configuration/networkdevices/fortinetfortigate.md index e2ec396d9b..6866ce6b5c 100644 --- a/docs/auditor/10.8/configuration/networkdevices/fortinetfortigate.md +++ b/docs/auditor/10.8/configuration/networkdevices/fortinetfortigate.md @@ -6,32 +6,21 @@ sidebar_position: 60 # Configure Fortinet FortiGate Devices -Netwrix Auditor relies on native logs for collecting audit data. Therefore, successful change and -access auditing requires a certain configuration of native audit settings in the audited environment -and on the Auditor console computer. Configuring your IT infrastructure may also include enabling -certain built-in Windows services, etc. Proper audit configuration is required to ensure audit data -integrity, otherwise your change reports may contain warnings, errors or incomplete audit data. - -**CAUTION:** Folder associated with Netwrix Auditor must be excluded from antivirus scanning. See -the +Netwrix Auditor relies on native syslog events for collecting audit data. Therefore, successful +change and access auditing requires a certain configuration of native audit settings in the audited +environment. Proper audit configuration ensures audit data integrity; otherwise, your change reports +may contain warnings, errors, or incomplete audit data. + +**CAUTION:** Exclude the folder associated with Netwrix Auditor from antivirus scanning. See the [Antivirus Exclusions for Netwrix Auditor](/docs/kb/auditor/system-administration/security-hardening/antivirus-exclusions-for-netwrix-auditor) knowledge base article for additional information. -You can configure your IT Infrastructure for monitoring in one of the following ways: - -- Automatically through a monitoring plan – This is a recommended method. If you select to - automatically configure audit in the target environment, your current audit settings will be - checked on each data collection and adjusted if necessary. -- Manually – Native audit settings must be adjusted manually to ensure collecting comprehensive and - reliable audit data. You can enable Auditor to continually enforce the relevant audit policies or - configure them manually: - - - The target Fortinet Fortigate device must be configured via Command Line Interface (CLI) as - described below. +Configure native audit settings manually on the Fortinet FortiGate device to ensure Netwrix +Auditor collects comprehensive and reliable audit data. To configure your Fortinet FortiGate devices, enable logging to multiple Syslog servers and -configure FortiOS to send log messages to remote syslog servers in CEF format. Do one of the -following: +configure FortiOS to send log messages to remote syslog servers in Common Event Format (CEF). Do +one of the following: - To configure Fortinet FortiGate devices via Command Line Interface - To configure Fortinet FortiGate devices through the Fortigate Management Console diff --git a/docs/auditor/10.8/configuration/networkdevices/juniper.md b/docs/auditor/10.8/configuration/networkdevices/juniper.md index 3110d05547..8d665dbb4d 100644 --- a/docs/auditor/10.8/configuration/networkdevices/juniper.md +++ b/docs/auditor/10.8/configuration/networkdevices/juniper.md @@ -6,51 +6,39 @@ sidebar_position: 80 # Configure Juniper Devices -Netwrix Auditor relies on native logs for collecting audit data. Therefore, successful change and -access auditing requires a certain configuration of native audit settings in the audited environment -and on the Auditor console computer. Configuring your IT infrastructure may also include enabling -certain built-in Windows services, etc. Proper audit configuration is required to ensure audit data -integrity, otherwise your change reports may contain warnings, errors or incomplete audit data. - -**CAUTION:** Folder associated with Netwrix Auditor must be excluded from antivirus scanning. See -the +Netwrix Auditor relies on native syslog events for collecting audit data. Therefore, successful +change and access auditing requires a certain configuration of native audit settings in the audited +environment. Proper audit configuration ensures audit data integrity; otherwise, your change reports +may contain warnings, errors, or incomplete audit data. + +**CAUTION:** Exclude the folder associated with Netwrix Auditor from antivirus scanning. See the [Antivirus Exclusions for Netwrix Auditor](/docs/kb/auditor/system-administration/security-hardening/antivirus-exclusions-for-netwrix-auditor) knowledge base article for additional information. -You can configure your IT Infrastructure for monitoring in one of the following ways: - -- Automatically through a monitoring plan – This is a recommended method. If you select to - automatically configure audit in the target environment, your current audit settings will be - checked on each data collection and adjusted if necessary. -- Manually – Native audit settings must be adjusted manually to ensure collecting comprehensive and - reliable audit data. You can enable Auditor to continually enforce the relevant audit policies or - configure them manually: - - - The target Juniper device must be configured via JunOS Command Line Interface (CLI) as - described below. +Configure native audit settings manually on the Juniper device to ensure Netwrix Auditor collects +comprehensive and reliable audit data. -To configure you Juniper devices, do the following: +To configure your Juniper devices, do the following: -1. Launch the JunOS Command Line Interface (CLI). +1. Launch the Junos OS command line interface (CLI). 2. Execute the following commands: # configure # set system syslog host `` any info - where `` is the IP address of the computer where Netwrix Auditor Server is - installed. + where `` is the IP address of the computer that hosts Netwrix Auditor Server. # set system syslog host `` port `` where - `` is the IP address of the computer where Netwrix Auditor Server is installed + `` is the IP address of the computer that hosts Netwrix Auditor Server AND - `` is the name of the UDP port used to listen to network devices (514 port used by - default). [Network Devices](/docs/auditor/10.8/admin/monitoringplans/networkdevices.md) + `` is the name of the UDP port that Netwrix Auditor uses to listen to network + devices (port 514 by default). [Network Devices](/docs/auditor/10.8/admin/monitoringplans/networkdevices.md) # set system syslog time-format `` diff --git a/docs/auditor/10.8/configuration/networkdevices/paloalto.md b/docs/auditor/10.8/configuration/networkdevices/paloalto.md index 4f14fc45d3..76e486862d 100644 --- a/docs/auditor/10.8/configuration/networkdevices/paloalto.md +++ b/docs/auditor/10.8/configuration/networkdevices/paloalto.md @@ -6,33 +6,20 @@ sidebar_position: 90 # Configure PaloAlto Devices -Netwrix Auditor relies on native logs for collecting audit data. Therefore, successful change and -access auditing requires a certain configuration of native audit settings in the audited environment -and on the Auditor console computer. Configuring your IT infrastructure may also include enabling -certain built-in Windows services, etc. Proper audit configuration is required to ensure audit data -integrity, otherwise your change reports may contain warnings, errors or incomplete audit data. - -**CAUTION:** Folder associated with Netwrix Auditor must be excluded from antivirus scanning. See -the +Netwrix Auditor relies on native syslog events for collecting audit data. Therefore, successful +change and access auditing requires a certain configuration of native audit settings in the audited +environment. Proper audit configuration ensures audit data integrity; otherwise, your change reports +may contain warnings, errors, or incomplete audit data. + +**CAUTION:** Exclude the folder associated with Netwrix Auditor from antivirus scanning. See the [Antivirus Exclusions for Netwrix Auditor](/docs/kb/auditor/system-administration/security-hardening/antivirus-exclusions-for-netwrix-auditor) knowledge base article for additional information. -You can configure your IT Infrastructure for monitoring in one of the following ways: - -- Automatically through a monitoring plan – This is a recommended method. If you select to - automatically configure audit in the target environment, your current audit settings will be - checked on each data collection and adjusted if necessary. -- Manually – Native audit settings must be adjusted manually to ensure collecting comprehensive and - reliable audit data. You can enable Auditor to continually enforce the relevant audit policies or - configure them manually: - - - Create a Syslog Server profile and syslog forwarding for the target PaloAlto device via Web - Interface as described below. - -To configure your PaloAlto devices, create a Syslog server profile and assign it to the log settings -for each log type. +Configure native audit settings manually on the Palo Alto device via the web interface to ensure +Netwrix Auditor collects comprehensive and reliable audit data. Create a syslog server profile and +assign it to the log settings for each log type. -Follow the steps to configure a Syslog server profile. +## Configure a syslog server profile **Step 1 –** Connect to your PaloAlto device: launch an Internet browser and enter the IP address of the firewall in the URL field (https://``). @@ -48,23 +35,24 @@ the firewall in the URL field (https://``). | Name | Specify unique name for a syslog server. | | Syslog Server | Provide a server name by entering its FQDN or IPv4 address. | | Transport | Select UDP. | -| Port | Provide the name of the UDP port used to listen to network devices (514 port used by default). | +| Port | Provide the name of the UDP port that Netwrix Auditor uses to listen to network devices (port 514 by default). | | Format | Select IETF. | | Facility | Netwrix recommends using default values. | -Follow the steps to configure syslog forwarding. +## Configure syslog forwarding **Step 1 –** In the Web Interface, navigate to **Device** > **Log Settings**. **Step 2 –** For System, Config, and User ID logs, click Add and enter unique name of your syslog server. -**Step 3 –** On the syslog panel, click Add and select the syslog profile you created above. +**Step 3 –** On the syslog panel, click Add and select the syslog server profile you created in +[Configure a syslog server profile](#configure-a-syslog-server-profile). **Step 4 –** Click **Commit** and review the logs on the syslog server. -**NOTE:** After configuring the monitoring plan, Netwrix Auditor will listen to the logs forwarded -by the Palo Alto device. +**NOTE:** After you configure the monitoring plan, Netwrix Auditor listens to the logs that the +Palo Alto device forwards. ## PaloAlto Devices diff --git a/docs/auditor/10.8/configuration/networkdevices/sonicwall.md b/docs/auditor/10.8/configuration/networkdevices/sonicwall.md index 49d7dc0148..0778713a8d 100644 --- a/docs/auditor/10.8/configuration/networkdevices/sonicwall.md +++ b/docs/auditor/10.8/configuration/networkdevices/sonicwall.md @@ -6,27 +6,17 @@ sidebar_position: 110 # Configure SonicWall Devices -Netwrix Auditor relies on native logs for collecting audit data. Therefore, successful change and -access auditing requires a certain configuration of native audit settings in the audited environment -and on the Auditor console computer. Configuring your IT infrastructure may also include enabling -certain built-in Windows services, etc. Proper audit configuration is required to ensure audit data -integrity, otherwise your change reports may contain warnings, errors or incomplete audit data. - -**CAUTION:** Folder associated with Netwrix Auditor must be excluded from antivirus scanning. See -the +Netwrix Auditor relies on native syslog events for collecting audit data. Therefore, successful +change and access auditing requires a certain configuration of native audit settings in the audited +environment. Proper audit configuration ensures audit data integrity; otherwise, your change reports +may contain warnings, errors, or incomplete audit data. + +**CAUTION:** Exclude the folder associated with Netwrix Auditor from antivirus scanning. See the [Antivirus Exclusions for Netwrix Auditor](/docs/kb/auditor/system-administration/security-hardening/antivirus-exclusions-for-netwrix-auditor) knowledge base article for additional information. -You can configure your IT Infrastructure for monitoring in one of the following ways: - -- Automatically through a monitoring plan – This is a recommended method. If you select to - automatically configure audit in the target environment, your current audit settings will be - checked on each data collection and adjusted if necessary. -- Manually – Native audit settings must be adjusted manually to ensure collecting comprehensive and - reliable audit data. You can enable Auditor to continually enforce the relevant audit policies or - configure them manually: - - - Configure log settings, depending on your device type. +Configure native audit settings manually on the SonicWall device to ensure Netwrix Auditor +collects comprehensive and reliable audit data. Adjust the log settings for your device type. To configure your SonicWall devices, do the following: @@ -43,7 +33,7 @@ To configure SonicWall Web Application Firewall | - Log Level - Alert Level - Syslog Level | Set to "Info". | | - Enable Audit Log - Send to Syslog Server in Audit Log Settings - Send to Syslog Server in Access Log Settings | Select these checkboxes. | | Primary Syslog Server | Enter the address of your Netwrix Auditor Server. | - | Primary Syslog Server Port | Provide the name of the UDP port used to listen to network devices (514 port used by default). | + | Primary Syslog Server Port | Provide the name of the UDP port that Netwrix Auditor uses to listen to network devices (port 514 by default). | 4. Click Accept. 5. Navigate to Log → Categories. @@ -70,7 +60,7 @@ To configure SonicWall SMA | - Log Level - Alert Level - Syslog Level | Set to "Info". | | - Enable Audit Log - Send to Syslog Server in Audit Log Settings - Send to Syslog Server in Access Log Settings | Select these checkboxes. | | Primary Syslog Server | Enter the address of your Netwrix Auditor Server. | - | Primary Syslog Server Port | Provide the name of the UDP port used to listen to network devices (514 port used by default). | + | Primary Syslog Server Port | Provide the name of the UDP port that Netwrix Auditor uses to listen to network devices (port 514 by default). | 4. Click Accept. 5. Navigate to Log → Categories. @@ -96,12 +86,12 @@ To configure SonicWall NS series 6. Navigate to Manage → Log Settings → Syslog. 7. Set the Syslog Format to Default. 8. Click Add. -9. In the dialog appears, select Create new address object option in the Name or IP Address combo - box. +9. In the dialog that appears, select the Create new address object option in the Name or IP + Address combo box. 10. Provide name and IP address of the new object. 11. Click OK. -12. In the Add Syslog Server dialog, find the IP address you specified on the step 10 in the Name or - IP Address list. +12. In the Add Syslog Server dialog, in the Name or IP Address list, find the IP address you + specified in step 10. 13. Click OK. 14. Click Save. @@ -112,16 +102,16 @@ Review a full list of object types Netwrix Auditor can collect on SonicWall netw | Object type | Actions | Event ID | | ------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Logon | - Successful logon | - User login from an internal zone allowed - User login successful - XAUTH Succeeded with VPN - VPN zone remote user login allowed - WAN zone remote user login allowed - PPP: Authentication successful - Local Authentication Success - RADIUS/LDAP Authentication Success - Successful authentication received for Remotely Triggered - IKEv2 Authentication successful - SSL VPN zone remote user login allowed | -| - Failed logon | - User login denied - User login failed - XAUTH Failed with VPN - L2TP PPP Authentication Failed - check username / password - RADIUS/LDAP reports Authentication Failure - Local Authentication Failure - User login to Administration Portal denied - User login failure rate exceeded - User Name authentication Failure locally - ISAKMP_AUTH_FAILED - Guest service limit reached - Guest login denied - Incorrect authentication received for Remotely Triggered - Authentication Timeout during Remotely Triggered - Problem occurred during user group membership retrieval - An error has occurred while sending your - IPsec Authentication Failed | | +| - Failed logon | - User login denied - User login failed - XAUTH Failed with VPN - L2TP PPP Authentication Failed - check username / password - RADIUS/LDAP reports Authentication Failure - Local Authentication Failure - User log in to Administration Portal denied - User login failure rate exceeded - User Name authentication Failure locally - ISAKMP_AUTH_FAILED - Guest service limit reached - Guest login denied - Incorrect authentication received for Remotely Triggered - Authentication Timeout during Remotely Triggered - Problem occurred during user group membership retrieval - An error has occurred while sending your - IPsec Authentication Failed | | | - Logoff | - User logged out - logged out - Guest Session Timeout - Guest Account Timeout - Guest Idle Timeout - Guest traffic quota exceeded | | | Authentication | - Successful Logon | - Administrator login allowed - CLI administrator login allowed - VPN zone administrator login allowed - WAN zone administrator login allowed - Configuration mode administration session started - Read-only mode GUI administration session started - Non-config mode GUI administration session started - User login successful - Session Start: - EventMessage: Session Start Success | -| - Failed Logon | - Administrator login denied - CLI administrator login denied due to bad credentials - User login failed - The account has been disabled for - is not permitted for this Web App - Authentication for user - Authentication failed - maximum authentication attempts exceeded for - EventMessage: Session Start Failed | | +| - Failed Logon | - Administrator login denied - CLI administrator login denied due to bad credentials - User login failed - The account has been disabled for - isn't permitted for this Web App - Authentication for user - Authentication failed - maximum authentication attempts exceeded for - EventMessage: Session Start Failed | | | - Logoff | - Administrator logged out - CLI administrator logged out - Configuration mode administration session ended - GUI administration session ended - Logged out - Session End: - EventMessage: Session End - Command='Tunnel' | | | Configuration | - Add / Added (Failed attempt) | - m=1333 - Scheduled settings generated - A new default Self-Signed certificate was generated successfully - Scheduled Tech Support Report generated - Restarted Tech Support Report generated | | - Modified / Modify (Failed attempt) | - Mail attachment disabled - Watch and report possible SYN floods - Watch and proxy WAN connections when under attack - Always proxy WAN connections - SYN Flood blacklisting enabled by user - SYN Flood blacklisting disabled by user - Administrator name changed - VPN disabled by administrator - VPN enabled by administrator - WLAN disabled by administrator - WLAN enabled by administrator - WLAN disabled by schedule - WLAN enabled by schedule - is added into Group - is removed from Group - m=1334 - Update administrator/user lockout params - Settings imported - Critical Operating System Update failed - msg=\"WAF restarted - HTTP(S) Cache settings were updated - database has been updated - Web Server Fingerprint Protection enforced - About to reconfigure service: - Finished applying configuration changes - Started - Start failed - Stopped | | -| - Read / Read (Failed attempt) | - m=1203 - m=1204 - Problem loading the URL list - Registration Update Needed, Please restore your existing security service subscriptions - Failed to synchronize license information with Licensing Server - Current settings exported - Error sending - settings sent successfully - Automated scheduled settings successful - Scheduled settings downloaded - Tech Support Report - Tech Support Report sent successfully - Loaded WAF signature database successfully - Error sending - logs sent out successfully | | +| - Read / Read (Failed attempt) | - m=1203 - m=1204 - Problem loading the URL list - Registration Update Needed, restore your existing security service subscriptions - Failed to synchronize license information with Licensing Server - Current settings exported - Error sending - settings sent successfully - Automated scheduled settings successful - Scheduled settings downloaded - Tech Support Report - Tech Support Report sent successfully - Loaded WAF signature database successfully - Error sending - logs sent out successfully | | | | - Remove / Removed (Failed attempt) | - Scheduled settings deleted - Oldest scheduled Tech Support Report deleted - has been deleted - Event Logs cleared - Audit Logs cleared - Access Logs cleared - Deleting log files - Deleting core files - Deleting snapshots older | -| Device state | - Modified / Modify (Failed attempt) | - Registration Update Needed, Please restore your existing security service subscriptions - Intrusion Prevention (IDP) subscription has expired - Failed to synchronize license information with Licensing Server | +| Device state | - Modified / Modify (Failed attempt) | - Registration Update Needed, restore your existing security service subscriptions - Intrusion Prevention (IDP) subscription has expired - Failed to synchronize license information with Licensing Server | | Folder | - Add / Added (Failed attempt) | - Request='GET /cgi-bin/sonicfiles?RacNumber=9&Arg1= | | - Read / Read (Failed attempt) | - Request='GET /cgi-bin/sonicfiles?RacNumber=16&Arg1= | | | - Remove / Removed (Failed attempt) | - Request='GET /cgi-bin/sonicfiles?RacNumber=13&Arg1= | | diff --git a/docs/auditor/10.9/configuration/networkdevices/ciscoasa.md b/docs/auditor/10.9/configuration/networkdevices/ciscoasa.md index 541311a546..31cc07277d 100644 --- a/docs/auditor/10.9/configuration/networkdevices/ciscoasa.md +++ b/docs/auditor/10.9/configuration/networkdevices/ciscoasa.md @@ -6,37 +6,27 @@ sidebar_position: 20 # Configure Cisco ASA Devices -Netwrix Auditor relies on native logs for collecting audit data. Therefore, successful change and -access auditing requires a certain configuration of native audit settings in the audited environment -and on the Auditor console computer. Configuring your IT infrastructure may also include enabling -certain built-in Windows services, etc. Proper audit configuration is required to ensure audit data -integrity, otherwise your change reports may contain warnings, errors or incomplete audit data. - -**CAUTION:** Folder associated with Netwrix Auditor must be excluded from antivirus scanning. See -the +Netwrix Auditor relies on native syslog events for collecting audit data. Therefore, successful +change and access auditing requires a certain configuration of native audit settings in the audited +environment. Proper audit configuration ensures audit data integrity; otherwise, your change reports +may contain warnings, errors, or incomplete audit data. + +**CAUTION:** Exclude the folder associated with Netwrix Auditor from antivirus scanning. See the [Antivirus Exclusions for Netwrix Auditor](/docs/kb/auditor/system-administration/security-hardening/antivirus-exclusions-for-netwrix-auditor) knowledge base article for additional information. -You can configure your IT Infrastructure for monitoring in one of the following ways: - -- Automatically through a monitoring plan – This is a recommended method. If you select to - automatically configure audit in the target environment, your current audit settings will be - checked on each data collection and adjusted if necessary. -- Manually – Native audit settings must be adjusted manually to ensure collecting comprehensive and - reliable audit data. You can enable Auditor to continually enforce the relevant audit policies or - configure them manually: +Netwrix Auditor can't push configuration changes to network devices, so configure native audit +settings manually on the Cisco ASA device. When you finish, the device has the following settings: - - On the Cisco ASA Device: +- The global configuration mode is enabled. +- The `logging enable` option is turned on. +- The `logging host` parameter is set to the host address of the audited Cisco ASA device, and the + device uses a UDP port (for example, 514) to send messages. - - The global configuration mode is selected. - - The `logging enable `option is selected on the Cisco ASA device. - - The `logging host` parameter is set to the host address of the audited CiscoASA device. - And UDP port (for, example 514) is used for sending messages. + **NOTE:** Don't select the EMBLEM format logging for the syslog server option. - **NOTE:** Do not select the EMBLEM format logging for the syslog server option. - - - The `logging timestamp` option enabled. - - The `logging trap` option is selected from 1 to 6 inclusive. +- The `logging timestamp` option is enabled. +- The `logging trap` option is set from 1 to 6 inclusive. To configure your Cisco ASA devices, do the following: @@ -53,13 +43,11 @@ To configure your Cisco ASA devices, do the following: hostname(config)# logging enable 4. Set the IP address of the computer that hosts Netwrix Auditor Server as the `logging host` - parameter. And make sure that the UDP port is used for sending syslog messages (e.g., 514 UDP + parameter, and ensure that the device uses a UDP port to send syslog messages (e.g., 514 UDP port). For example: hostname(config)# logging host `` - Do not select the EMBLEM format logging for the syslog server option. - 5. Enable the `logging timestamp` option. For example: hostname(config)# logging timestamp diff --git a/docs/auditor/10.9/configuration/networkdevices/ciscoios.md b/docs/auditor/10.9/configuration/networkdevices/ciscoios.md index b4f9448cd2..94b90a85d5 100644 --- a/docs/auditor/10.9/configuration/networkdevices/ciscoios.md +++ b/docs/auditor/10.9/configuration/networkdevices/ciscoios.md @@ -6,31 +6,23 @@ sidebar_position: 30 # Configure Cisco IOS Devices -Netwrix Auditor relies on native logs for collecting audit data. Therefore, successful change and -access auditing requires a certain configuration of native audit settings in the audited environment -and on the Auditor console computer. Configuring your IT infrastructure may also include enabling -certain built-in Windows services, etc. Proper audit configuration is required to ensure audit data -integrity, otherwise your change reports may contain warnings, errors or incomplete audit data. - -**CAUTION:** Folder associated with Netwrix Auditor must be excluded from antivirus scanning. See -the +Netwrix Auditor relies on native syslog events for collecting audit data. Therefore, successful +change and access auditing requires a certain configuration of native audit settings in the audited +environment. Proper audit configuration ensures audit data integrity; otherwise, your change reports +may contain warnings, errors, or incomplete audit data. + +**CAUTION:** Exclude the folder associated with Netwrix Auditor from antivirus scanning. See the [Antivirus Exclusions for Netwrix Auditor](/docs/kb/auditor/system-administration/security-hardening/antivirus-exclusions-for-netwrix-auditor) knowledge base article for additional information. -You can configure your IT Infrastructure for monitoring in one of the following ways: - -- Automatically through a monitoring plan – This is a recommended method. If you select to - automatically configure audit in the target environment, your current audit settings will be - checked on each data collection and adjusted if necessary. -- Manually – Native audit settings must be adjusted manually to ensure collecting comprehensive and - reliable audit data. You can enable Auditor to continually enforce the relevant audit policies or - configure them manually: +Netwrix Auditor can't push configuration changes to network devices, so configure native audit +settings manually on the Cisco IOS device. When you finish, the device has the following settings: - - The global configuration mode is selected. - - The `logging timestamp` option enabled. - - The `logging trap` option is selected from 1 to 6 inclusive. - - The `logging host` parameter is set to the host address where the service is going to be - installed. And UDP port (for, example 514) is used for sending messages. +- The global configuration mode is enabled. +- The `logging timestamp` option is enabled. +- The `logging trap` option is set from 1 to 6 inclusive. +- The `logging host` parameter is set to the host address of the computer that hosts Netwrix + Auditor Server, and the device uses a UDP port (for example, 514) to send messages. To configure your Cisco IOS devices, do the following: @@ -48,8 +40,8 @@ To configure your Cisco IOS devices, do the following: Router# logging trap 5 -5. Set the IP address of the Netwrix Auditor Server as the logging host parameter. And make sure - that the UDP port is used for sending syslog messages (e.g., 514 UDP port). For example: +5. Set the IP address of the Netwrix Auditor Server as the logging host parameter, and ensure that + the device uses a UDP port to send syslog messages (e.g., 514 UDP port). For example: Router# logging 192.168.1.5 diff --git a/docs/auditor/10.9/configuration/networkdevices/fortinetfortigate.md b/docs/auditor/10.9/configuration/networkdevices/fortinetfortigate.md index e2ec396d9b..6866ce6b5c 100644 --- a/docs/auditor/10.9/configuration/networkdevices/fortinetfortigate.md +++ b/docs/auditor/10.9/configuration/networkdevices/fortinetfortigate.md @@ -6,32 +6,21 @@ sidebar_position: 60 # Configure Fortinet FortiGate Devices -Netwrix Auditor relies on native logs for collecting audit data. Therefore, successful change and -access auditing requires a certain configuration of native audit settings in the audited environment -and on the Auditor console computer. Configuring your IT infrastructure may also include enabling -certain built-in Windows services, etc. Proper audit configuration is required to ensure audit data -integrity, otherwise your change reports may contain warnings, errors or incomplete audit data. - -**CAUTION:** Folder associated with Netwrix Auditor must be excluded from antivirus scanning. See -the +Netwrix Auditor relies on native syslog events for collecting audit data. Therefore, successful +change and access auditing requires a certain configuration of native audit settings in the audited +environment. Proper audit configuration ensures audit data integrity; otherwise, your change reports +may contain warnings, errors, or incomplete audit data. + +**CAUTION:** Exclude the folder associated with Netwrix Auditor from antivirus scanning. See the [Antivirus Exclusions for Netwrix Auditor](/docs/kb/auditor/system-administration/security-hardening/antivirus-exclusions-for-netwrix-auditor) knowledge base article for additional information. -You can configure your IT Infrastructure for monitoring in one of the following ways: - -- Automatically through a monitoring plan – This is a recommended method. If you select to - automatically configure audit in the target environment, your current audit settings will be - checked on each data collection and adjusted if necessary. -- Manually – Native audit settings must be adjusted manually to ensure collecting comprehensive and - reliable audit data. You can enable Auditor to continually enforce the relevant audit policies or - configure them manually: - - - The target Fortinet Fortigate device must be configured via Command Line Interface (CLI) as - described below. +Configure native audit settings manually on the Fortinet FortiGate device to ensure Netwrix +Auditor collects comprehensive and reliable audit data. To configure your Fortinet FortiGate devices, enable logging to multiple Syslog servers and -configure FortiOS to send log messages to remote syslog servers in CEF format. Do one of the -following: +configure FortiOS to send log messages to remote syslog servers in Common Event Format (CEF). Do +one of the following: - To configure Fortinet FortiGate devices via Command Line Interface - To configure Fortinet FortiGate devices through the Fortigate Management Console diff --git a/docs/auditor/10.9/configuration/networkdevices/juniper.md b/docs/auditor/10.9/configuration/networkdevices/juniper.md index 6ebc05919d..9eafa278cb 100644 --- a/docs/auditor/10.9/configuration/networkdevices/juniper.md +++ b/docs/auditor/10.9/configuration/networkdevices/juniper.md @@ -6,51 +6,39 @@ sidebar_position: 80 # Configure Juniper Devices -Netwrix Auditor relies on native logs for collecting audit data. Therefore, successful change and -access auditing requires a certain configuration of native audit settings in the audited environment -and on the Auditor console computer. Configuring your IT infrastructure may also include enabling -certain built-in Windows services, etc. Proper audit configuration is required to ensure audit data -integrity, otherwise your change reports may contain warnings, errors or incomplete audit data. - -**CAUTION:** Folder associated with Netwrix Auditor must be excluded from antivirus scanning. See -the +Netwrix Auditor relies on native syslog events for collecting audit data. Therefore, successful +change and access auditing requires a certain configuration of native audit settings in the audited +environment. Proper audit configuration ensures audit data integrity; otherwise, your change reports +may contain warnings, errors, or incomplete audit data. + +**CAUTION:** Exclude the folder associated with Netwrix Auditor from antivirus scanning. See the [Antivirus Exclusions for Netwrix Auditor](/docs/kb/auditor/system-administration/security-hardening/antivirus-exclusions-for-netwrix-auditor) knowledge base article for additional information. -You can configure your IT Infrastructure for monitoring in one of the following ways: - -- Automatically through a monitoring plan – This is a recommended method. If you select to - automatically configure audit in the target environment, your current audit settings will be - checked on each data collection and adjusted if necessary. -- Manually – Native audit settings must be adjusted manually to ensure collecting comprehensive and - reliable audit data. You can enable Auditor to continually enforce the relevant audit policies or - configure them manually: - - - The target Juniper device must be configured via JunOS Command Line Interface (CLI) as - described below. +Configure native audit settings manually on the Juniper device to ensure Netwrix Auditor collects +comprehensive and reliable audit data. -To configure you Juniper devices, do the following: +To configure your Juniper devices, do the following: -1. Launch the JunOS Command Line Interface (CLI). +1. Launch the Junos OS command line interface (CLI). 2. Execute the following commands: # configure # set system syslog host `` any info - where `` is the IP address of the computer where Netwrix Auditor Server is - installed. + where `` is the IP address of the computer that hosts Netwrix Auditor Server. # set system syslog host `` port `` where - `` is the IP address of the computer where Netwrix Auditor Server is installed + `` is the IP address of the computer that hosts Netwrix Auditor Server AND - `` is the name of the UDP port used to listen to network devices (514 port used by - default). [Network Devices](/docs/auditor/10.9/admin/monitoringplans/networkdevices.md) + `` is the name of the UDP port that Netwrix Auditor uses to listen to network + devices (port 514 by default). [Network Devices](/docs/auditor/10.9/admin/monitoringplans/networkdevices.md) # set system syslog time-format `` diff --git a/docs/auditor/10.9/configuration/networkdevices/paloalto.md b/docs/auditor/10.9/configuration/networkdevices/paloalto.md index 4f14fc45d3..76e486862d 100644 --- a/docs/auditor/10.9/configuration/networkdevices/paloalto.md +++ b/docs/auditor/10.9/configuration/networkdevices/paloalto.md @@ -6,33 +6,20 @@ sidebar_position: 90 # Configure PaloAlto Devices -Netwrix Auditor relies on native logs for collecting audit data. Therefore, successful change and -access auditing requires a certain configuration of native audit settings in the audited environment -and on the Auditor console computer. Configuring your IT infrastructure may also include enabling -certain built-in Windows services, etc. Proper audit configuration is required to ensure audit data -integrity, otherwise your change reports may contain warnings, errors or incomplete audit data. - -**CAUTION:** Folder associated with Netwrix Auditor must be excluded from antivirus scanning. See -the +Netwrix Auditor relies on native syslog events for collecting audit data. Therefore, successful +change and access auditing requires a certain configuration of native audit settings in the audited +environment. Proper audit configuration ensures audit data integrity; otherwise, your change reports +may contain warnings, errors, or incomplete audit data. + +**CAUTION:** Exclude the folder associated with Netwrix Auditor from antivirus scanning. See the [Antivirus Exclusions for Netwrix Auditor](/docs/kb/auditor/system-administration/security-hardening/antivirus-exclusions-for-netwrix-auditor) knowledge base article for additional information. -You can configure your IT Infrastructure for monitoring in one of the following ways: - -- Automatically through a monitoring plan – This is a recommended method. If you select to - automatically configure audit in the target environment, your current audit settings will be - checked on each data collection and adjusted if necessary. -- Manually – Native audit settings must be adjusted manually to ensure collecting comprehensive and - reliable audit data. You can enable Auditor to continually enforce the relevant audit policies or - configure them manually: - - - Create a Syslog Server profile and syslog forwarding for the target PaloAlto device via Web - Interface as described below. - -To configure your PaloAlto devices, create a Syslog server profile and assign it to the log settings -for each log type. +Configure native audit settings manually on the Palo Alto device via the web interface to ensure +Netwrix Auditor collects comprehensive and reliable audit data. Create a syslog server profile and +assign it to the log settings for each log type. -Follow the steps to configure a Syslog server profile. +## Configure a syslog server profile **Step 1 –** Connect to your PaloAlto device: launch an Internet browser and enter the IP address of the firewall in the URL field (https://``). @@ -48,23 +35,24 @@ the firewall in the URL field (https://``). | Name | Specify unique name for a syslog server. | | Syslog Server | Provide a server name by entering its FQDN or IPv4 address. | | Transport | Select UDP. | -| Port | Provide the name of the UDP port used to listen to network devices (514 port used by default). | +| Port | Provide the name of the UDP port that Netwrix Auditor uses to listen to network devices (port 514 by default). | | Format | Select IETF. | | Facility | Netwrix recommends using default values. | -Follow the steps to configure syslog forwarding. +## Configure syslog forwarding **Step 1 –** In the Web Interface, navigate to **Device** > **Log Settings**. **Step 2 –** For System, Config, and User ID logs, click Add and enter unique name of your syslog server. -**Step 3 –** On the syslog panel, click Add and select the syslog profile you created above. +**Step 3 –** On the syslog panel, click Add and select the syslog server profile you created in +[Configure a syslog server profile](#configure-a-syslog-server-profile). **Step 4 –** Click **Commit** and review the logs on the syslog server. -**NOTE:** After configuring the monitoring plan, Netwrix Auditor will listen to the logs forwarded -by the Palo Alto device. +**NOTE:** After you configure the monitoring plan, Netwrix Auditor listens to the logs that the +Palo Alto device forwards. ## PaloAlto Devices diff --git a/docs/auditor/10.9/configuration/networkdevices/sonicwall.md b/docs/auditor/10.9/configuration/networkdevices/sonicwall.md index 49d7dc0148..0778713a8d 100644 --- a/docs/auditor/10.9/configuration/networkdevices/sonicwall.md +++ b/docs/auditor/10.9/configuration/networkdevices/sonicwall.md @@ -6,27 +6,17 @@ sidebar_position: 110 # Configure SonicWall Devices -Netwrix Auditor relies on native logs for collecting audit data. Therefore, successful change and -access auditing requires a certain configuration of native audit settings in the audited environment -and on the Auditor console computer. Configuring your IT infrastructure may also include enabling -certain built-in Windows services, etc. Proper audit configuration is required to ensure audit data -integrity, otherwise your change reports may contain warnings, errors or incomplete audit data. - -**CAUTION:** Folder associated with Netwrix Auditor must be excluded from antivirus scanning. See -the +Netwrix Auditor relies on native syslog events for collecting audit data. Therefore, successful +change and access auditing requires a certain configuration of native audit settings in the audited +environment. Proper audit configuration ensures audit data integrity; otherwise, your change reports +may contain warnings, errors, or incomplete audit data. + +**CAUTION:** Exclude the folder associated with Netwrix Auditor from antivirus scanning. See the [Antivirus Exclusions for Netwrix Auditor](/docs/kb/auditor/system-administration/security-hardening/antivirus-exclusions-for-netwrix-auditor) knowledge base article for additional information. -You can configure your IT Infrastructure for monitoring in one of the following ways: - -- Automatically through a monitoring plan – This is a recommended method. If you select to - automatically configure audit in the target environment, your current audit settings will be - checked on each data collection and adjusted if necessary. -- Manually – Native audit settings must be adjusted manually to ensure collecting comprehensive and - reliable audit data. You can enable Auditor to continually enforce the relevant audit policies or - configure them manually: - - - Configure log settings, depending on your device type. +Configure native audit settings manually on the SonicWall device to ensure Netwrix Auditor +collects comprehensive and reliable audit data. Adjust the log settings for your device type. To configure your SonicWall devices, do the following: @@ -43,7 +33,7 @@ To configure SonicWall Web Application Firewall | - Log Level - Alert Level - Syslog Level | Set to "Info". | | - Enable Audit Log - Send to Syslog Server in Audit Log Settings - Send to Syslog Server in Access Log Settings | Select these checkboxes. | | Primary Syslog Server | Enter the address of your Netwrix Auditor Server. | - | Primary Syslog Server Port | Provide the name of the UDP port used to listen to network devices (514 port used by default). | + | Primary Syslog Server Port | Provide the name of the UDP port that Netwrix Auditor uses to listen to network devices (port 514 by default). | 4. Click Accept. 5. Navigate to Log → Categories. @@ -70,7 +60,7 @@ To configure SonicWall SMA | - Log Level - Alert Level - Syslog Level | Set to "Info". | | - Enable Audit Log - Send to Syslog Server in Audit Log Settings - Send to Syslog Server in Access Log Settings | Select these checkboxes. | | Primary Syslog Server | Enter the address of your Netwrix Auditor Server. | - | Primary Syslog Server Port | Provide the name of the UDP port used to listen to network devices (514 port used by default). | + | Primary Syslog Server Port | Provide the name of the UDP port that Netwrix Auditor uses to listen to network devices (port 514 by default). | 4. Click Accept. 5. Navigate to Log → Categories. @@ -96,12 +86,12 @@ To configure SonicWall NS series 6. Navigate to Manage → Log Settings → Syslog. 7. Set the Syslog Format to Default. 8. Click Add. -9. In the dialog appears, select Create new address object option in the Name or IP Address combo - box. +9. In the dialog that appears, select the Create new address object option in the Name or IP + Address combo box. 10. Provide name and IP address of the new object. 11. Click OK. -12. In the Add Syslog Server dialog, find the IP address you specified on the step 10 in the Name or - IP Address list. +12. In the Add Syslog Server dialog, in the Name or IP Address list, find the IP address you + specified in step 10. 13. Click OK. 14. Click Save. @@ -112,16 +102,16 @@ Review a full list of object types Netwrix Auditor can collect on SonicWall netw | Object type | Actions | Event ID | | ------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Logon | - Successful logon | - User login from an internal zone allowed - User login successful - XAUTH Succeeded with VPN - VPN zone remote user login allowed - WAN zone remote user login allowed - PPP: Authentication successful - Local Authentication Success - RADIUS/LDAP Authentication Success - Successful authentication received for Remotely Triggered - IKEv2 Authentication successful - SSL VPN zone remote user login allowed | -| - Failed logon | - User login denied - User login failed - XAUTH Failed with VPN - L2TP PPP Authentication Failed - check username / password - RADIUS/LDAP reports Authentication Failure - Local Authentication Failure - User login to Administration Portal denied - User login failure rate exceeded - User Name authentication Failure locally - ISAKMP_AUTH_FAILED - Guest service limit reached - Guest login denied - Incorrect authentication received for Remotely Triggered - Authentication Timeout during Remotely Triggered - Problem occurred during user group membership retrieval - An error has occurred while sending your - IPsec Authentication Failed | | +| - Failed logon | - User login denied - User login failed - XAUTH Failed with VPN - L2TP PPP Authentication Failed - check username / password - RADIUS/LDAP reports Authentication Failure - Local Authentication Failure - User log in to Administration Portal denied - User login failure rate exceeded - User Name authentication Failure locally - ISAKMP_AUTH_FAILED - Guest service limit reached - Guest login denied - Incorrect authentication received for Remotely Triggered - Authentication Timeout during Remotely Triggered - Problem occurred during user group membership retrieval - An error has occurred while sending your - IPsec Authentication Failed | | | - Logoff | - User logged out - logged out - Guest Session Timeout - Guest Account Timeout - Guest Idle Timeout - Guest traffic quota exceeded | | | Authentication | - Successful Logon | - Administrator login allowed - CLI administrator login allowed - VPN zone administrator login allowed - WAN zone administrator login allowed - Configuration mode administration session started - Read-only mode GUI administration session started - Non-config mode GUI administration session started - User login successful - Session Start: - EventMessage: Session Start Success | -| - Failed Logon | - Administrator login denied - CLI administrator login denied due to bad credentials - User login failed - The account has been disabled for - is not permitted for this Web App - Authentication for user - Authentication failed - maximum authentication attempts exceeded for - EventMessage: Session Start Failed | | +| - Failed Logon | - Administrator login denied - CLI administrator login denied due to bad credentials - User login failed - The account has been disabled for - isn't permitted for this Web App - Authentication for user - Authentication failed - maximum authentication attempts exceeded for - EventMessage: Session Start Failed | | | - Logoff | - Administrator logged out - CLI administrator logged out - Configuration mode administration session ended - GUI administration session ended - Logged out - Session End: - EventMessage: Session End - Command='Tunnel' | | | Configuration | - Add / Added (Failed attempt) | - m=1333 - Scheduled settings generated - A new default Self-Signed certificate was generated successfully - Scheduled Tech Support Report generated - Restarted Tech Support Report generated | | - Modified / Modify (Failed attempt) | - Mail attachment disabled - Watch and report possible SYN floods - Watch and proxy WAN connections when under attack - Always proxy WAN connections - SYN Flood blacklisting enabled by user - SYN Flood blacklisting disabled by user - Administrator name changed - VPN disabled by administrator - VPN enabled by administrator - WLAN disabled by administrator - WLAN enabled by administrator - WLAN disabled by schedule - WLAN enabled by schedule - is added into Group - is removed from Group - m=1334 - Update administrator/user lockout params - Settings imported - Critical Operating System Update failed - msg=\"WAF restarted - HTTP(S) Cache settings were updated - database has been updated - Web Server Fingerprint Protection enforced - About to reconfigure service: - Finished applying configuration changes - Started - Start failed - Stopped | | -| - Read / Read (Failed attempt) | - m=1203 - m=1204 - Problem loading the URL list - Registration Update Needed, Please restore your existing security service subscriptions - Failed to synchronize license information with Licensing Server - Current settings exported - Error sending - settings sent successfully - Automated scheduled settings successful - Scheduled settings downloaded - Tech Support Report - Tech Support Report sent successfully - Loaded WAF signature database successfully - Error sending - logs sent out successfully | | +| - Read / Read (Failed attempt) | - m=1203 - m=1204 - Problem loading the URL list - Registration Update Needed, restore your existing security service subscriptions - Failed to synchronize license information with Licensing Server - Current settings exported - Error sending - settings sent successfully - Automated scheduled settings successful - Scheduled settings downloaded - Tech Support Report - Tech Support Report sent successfully - Loaded WAF signature database successfully - Error sending - logs sent out successfully | | | | - Remove / Removed (Failed attempt) | - Scheduled settings deleted - Oldest scheduled Tech Support Report deleted - has been deleted - Event Logs cleared - Audit Logs cleared - Access Logs cleared - Deleting log files - Deleting core files - Deleting snapshots older | -| Device state | - Modified / Modify (Failed attempt) | - Registration Update Needed, Please restore your existing security service subscriptions - Intrusion Prevention (IDP) subscription has expired - Failed to synchronize license information with Licensing Server | +| Device state | - Modified / Modify (Failed attempt) | - Registration Update Needed, restore your existing security service subscriptions - Intrusion Prevention (IDP) subscription has expired - Failed to synchronize license information with Licensing Server | | Folder | - Add / Added (Failed attempt) | - Request='GET /cgi-bin/sonicfiles?RacNumber=9&Arg1= | | - Read / Read (Failed attempt) | - Request='GET /cgi-bin/sonicfiles?RacNumber=16&Arg1= | | | - Remove / Removed (Failed attempt) | - Request='GET /cgi-bin/sonicfiles?RacNumber=13&Arg1= | |