From cd6f9c027545bf2fcb96ec3f8b09f31f5ef4d673 Mon Sep 17 00:00:00 2001 From: TheCat Date: Tue, 18 Aug 2026 20:12:26 +0100 Subject: [PATCH 1/9] Fix misleading automatic-config claim in network device docs Cisco ASA, Cisco IOS, Fortinet FortiGate, Juniper, PaloAlto, and SonicWall device docs presented a choice between configuring native audit settings 'Automatically through a monitoring plan' or manually. In practice, Netwrix Auditor cannot push audit configuration to these network devices - settings must always be configured manually on the device itself. Removed the misleading automatic-configuration option and reworded the intro to state plainly that configuration is manual, matching the existing HPE Aruba and Cisco Meraki docs. Applied to Auditor 10.7, 10.8, and 10.9. Co-Authored-By: Claude Sonnet 5 --- .../configuration/networkdevices/ciscoasa.md | 26 +++++++------------ .../configuration/networkdevices/ciscoios.md | 22 ++++++---------- .../networkdevices/fortinetfortigate.md | 13 ++-------- .../configuration/networkdevices/juniper.md | 13 ++-------- .../configuration/networkdevices/paloalto.md | 14 +++------- .../configuration/networkdevices/sonicwall.md | 13 +++------- .../configuration/networkdevices/ciscoasa.md | 26 +++++++------------ .../configuration/networkdevices/ciscoios.md | 22 ++++++---------- .../networkdevices/fortinetfortigate.md | 13 ++-------- .../configuration/networkdevices/juniper.md | 13 ++-------- .../configuration/networkdevices/paloalto.md | 14 +++------- .../configuration/networkdevices/sonicwall.md | 13 +++------- .../configuration/networkdevices/ciscoasa.md | 26 +++++++------------ .../configuration/networkdevices/ciscoios.md | 22 ++++++---------- .../networkdevices/fortinetfortigate.md | 13 ++-------- .../configuration/networkdevices/juniper.md | 13 ++-------- .../configuration/networkdevices/paloalto.md | 14 +++------- .../configuration/networkdevices/sonicwall.md | 13 +++------- 18 files changed, 81 insertions(+), 222 deletions(-) diff --git a/docs/auditor/10.7/configuration/networkdevices/ciscoasa.md b/docs/auditor/10.7/configuration/networkdevices/ciscoasa.md index 541311a546..f74d422ca4 100644 --- a/docs/auditor/10.7/configuration/networkdevices/ciscoasa.md +++ b/docs/auditor/10.7/configuration/networkdevices/ciscoasa.md @@ -17,26 +17,18 @@ the [Antivirus Exclusions for Netwrix Auditor](/docs/kb/auditor/system-administration/security-hardening/antivirus-exclusions-for-netwrix-auditor) knowledge base article for additional information. -You can configure your IT Infrastructure for monitoring in one of the following ways: +Configure native audit settings manually on the Cisco ASA device to ensure Netwrix Auditor +collects comprehensive and reliable audit data: -- Automatically through a monitoring plan – This is a recommended method. If you select to - automatically configure audit in the target environment, your current audit settings will be - checked on each data collection and adjusted if necessary. -- Manually – Native audit settings must be adjusted manually to ensure collecting comprehensive and - reliable audit data. You can enable Auditor to continually enforce the relevant audit policies or - configure them manually: +- The global configuration mode is selected. +- The `logging enable `option is selected on the Cisco ASA device. +- The `logging host` parameter is set to the host address of the audited CiscoASA device. And UDP + port (for, example 514) is used for sending messages. - - On the Cisco ASA Device: + **NOTE:** Do not select the EMBLEM format logging for the syslog server option. - - The global configuration mode is selected. - - The `logging enable `option is selected on the Cisco ASA device. - - The `logging host` parameter is set to the host address of the audited CiscoASA device. - And UDP port (for, example 514) is used for sending messages. - - **NOTE:** Do not select the EMBLEM format logging for the syslog server option. - - - The `logging timestamp` option enabled. - - The `logging trap` option is selected from 1 to 6 inclusive. +- The `logging timestamp` option enabled. +- The `logging trap` option is selected from 1 to 6 inclusive. To configure your Cisco ASA devices, do the following: diff --git a/docs/auditor/10.7/configuration/networkdevices/ciscoios.md b/docs/auditor/10.7/configuration/networkdevices/ciscoios.md index b4f9448cd2..b9aef17b14 100644 --- a/docs/auditor/10.7/configuration/networkdevices/ciscoios.md +++ b/docs/auditor/10.7/configuration/networkdevices/ciscoios.md @@ -17,20 +17,14 @@ the [Antivirus Exclusions for Netwrix Auditor](/docs/kb/auditor/system-administration/security-hardening/antivirus-exclusions-for-netwrix-auditor) knowledge base article for additional information. -You can configure your IT Infrastructure for monitoring in one of the following ways: - -- Automatically through a monitoring plan – This is a recommended method. If you select to - automatically configure audit in the target environment, your current audit settings will be - checked on each data collection and adjusted if necessary. -- Manually – Native audit settings must be adjusted manually to ensure collecting comprehensive and - reliable audit data. You can enable Auditor to continually enforce the relevant audit policies or - configure them manually: - - - The global configuration mode is selected. - - The `logging timestamp` option enabled. - - The `logging trap` option is selected from 1 to 6 inclusive. - - The `logging host` parameter is set to the host address where the service is going to be - installed. And UDP port (for, example 514) is used for sending messages. +Configure native audit settings manually on the Cisco IOS device to ensure Netwrix Auditor +collects comprehensive and reliable audit data: + +- The global configuration mode is selected. +- The `logging timestamp` option enabled. +- The `logging trap` option is selected from 1 to 6 inclusive. +- The `logging host` parameter is set to the host address where the service is going to be + installed. And UDP port (for, example 514) is used for sending messages. To configure your Cisco IOS devices, do the following: diff --git a/docs/auditor/10.7/configuration/networkdevices/fortinetfortigate.md b/docs/auditor/10.7/configuration/networkdevices/fortinetfortigate.md index e2ec396d9b..e71df2c3c5 100644 --- a/docs/auditor/10.7/configuration/networkdevices/fortinetfortigate.md +++ b/docs/auditor/10.7/configuration/networkdevices/fortinetfortigate.md @@ -17,17 +17,8 @@ the [Antivirus Exclusions for Netwrix Auditor](/docs/kb/auditor/system-administration/security-hardening/antivirus-exclusions-for-netwrix-auditor) knowledge base article for additional information. -You can configure your IT Infrastructure for monitoring in one of the following ways: - -- Automatically through a monitoring plan – This is a recommended method. If you select to - automatically configure audit in the target environment, your current audit settings will be - checked on each data collection and adjusted if necessary. -- Manually – Native audit settings must be adjusted manually to ensure collecting comprehensive and - reliable audit data. You can enable Auditor to continually enforce the relevant audit policies or - configure them manually: - - - The target Fortinet Fortigate device must be configured via Command Line Interface (CLI) as - described below. +Configure native audit settings manually on the Fortinet FortiGate device via Command Line +Interface (CLI) to ensure Netwrix Auditor collects comprehensive and reliable audit data. To configure your Fortinet FortiGate devices, enable logging to multiple Syslog servers and configure FortiOS to send log messages to remote syslog servers in CEF format. Do one of the diff --git a/docs/auditor/10.7/configuration/networkdevices/juniper.md b/docs/auditor/10.7/configuration/networkdevices/juniper.md index 42e08c3ee4..fb640cec8e 100644 --- a/docs/auditor/10.7/configuration/networkdevices/juniper.md +++ b/docs/auditor/10.7/configuration/networkdevices/juniper.md @@ -17,17 +17,8 @@ the [Antivirus Exclusions for Netwrix Auditor](/docs/kb/auditor/system-administration/security-hardening/antivirus-exclusions-for-netwrix-auditor) knowledge base article for additional information. -You can configure your IT Infrastructure for monitoring in one of the following ways: - -- Automatically through a monitoring plan – This is a recommended method. If you select to - automatically configure audit in the target environment, your current audit settings will be - checked on each data collection and adjusted if necessary. -- Manually – Native audit settings must be adjusted manually to ensure collecting comprehensive and - reliable audit data. You can enable Auditor to continually enforce the relevant audit policies or - configure them manually: - - - The target Juniper device must be configured via JunOS Command Line Interface (CLI) as - described below. +Configure native audit settings manually on the Juniper device via JunOS Command Line +Interface (CLI) to ensure Netwrix Auditor collects comprehensive and reliable audit data. To configure you Juniper devices, do the following: diff --git a/docs/auditor/10.7/configuration/networkdevices/paloalto.md b/docs/auditor/10.7/configuration/networkdevices/paloalto.md index 4f14fc45d3..9350081717 100644 --- a/docs/auditor/10.7/configuration/networkdevices/paloalto.md +++ b/docs/auditor/10.7/configuration/networkdevices/paloalto.md @@ -17,17 +17,9 @@ the [Antivirus Exclusions for Netwrix Auditor](/docs/kb/auditor/system-administration/security-hardening/antivirus-exclusions-for-netwrix-auditor) knowledge base article for additional information. -You can configure your IT Infrastructure for monitoring in one of the following ways: - -- Automatically through a monitoring plan – This is a recommended method. If you select to - automatically configure audit in the target environment, your current audit settings will be - checked on each data collection and adjusted if necessary. -- Manually – Native audit settings must be adjusted manually to ensure collecting comprehensive and - reliable audit data. You can enable Auditor to continually enforce the relevant audit policies or - configure them manually: - - - Create a Syslog Server profile and syslog forwarding for the target PaloAlto device via Web - Interface as described below. +Configure native audit settings manually on the PaloAlto device via Web Interface to ensure +Netwrix Auditor collects comprehensive and reliable audit data: create a Syslog Server profile and +syslog forwarding for the target PaloAlto device. To configure your PaloAlto devices, create a Syslog server profile and assign it to the log settings for each log type. diff --git a/docs/auditor/10.7/configuration/networkdevices/sonicwall.md b/docs/auditor/10.7/configuration/networkdevices/sonicwall.md index 49d7dc0148..4a90d8a2e9 100644 --- a/docs/auditor/10.7/configuration/networkdevices/sonicwall.md +++ b/docs/auditor/10.7/configuration/networkdevices/sonicwall.md @@ -17,16 +17,9 @@ the [Antivirus Exclusions for Netwrix Auditor](/docs/kb/auditor/system-administration/security-hardening/antivirus-exclusions-for-netwrix-auditor) knowledge base article for additional information. -You can configure your IT Infrastructure for monitoring in one of the following ways: - -- Automatically through a monitoring plan – This is a recommended method. If you select to - automatically configure audit in the target environment, your current audit settings will be - checked on each data collection and adjusted if necessary. -- Manually – Native audit settings must be adjusted manually to ensure collecting comprehensive and - reliable audit data. You can enable Auditor to continually enforce the relevant audit policies or - configure them manually: - - - Configure log settings, depending on your device type. +Configure native audit settings manually on the SonicWall device to ensure Netwrix Auditor +collects comprehensive and reliable audit data. Configure log settings, depending on your device +type. To configure your SonicWall devices, do the following: diff --git a/docs/auditor/10.8/configuration/networkdevices/ciscoasa.md b/docs/auditor/10.8/configuration/networkdevices/ciscoasa.md index 541311a546..f74d422ca4 100644 --- a/docs/auditor/10.8/configuration/networkdevices/ciscoasa.md +++ b/docs/auditor/10.8/configuration/networkdevices/ciscoasa.md @@ -17,26 +17,18 @@ the [Antivirus Exclusions for Netwrix Auditor](/docs/kb/auditor/system-administration/security-hardening/antivirus-exclusions-for-netwrix-auditor) knowledge base article for additional information. -You can configure your IT Infrastructure for monitoring in one of the following ways: +Configure native audit settings manually on the Cisco ASA device to ensure Netwrix Auditor +collects comprehensive and reliable audit data: -- Automatically through a monitoring plan – This is a recommended method. If you select to - automatically configure audit in the target environment, your current audit settings will be - checked on each data collection and adjusted if necessary. -- Manually – Native audit settings must be adjusted manually to ensure collecting comprehensive and - reliable audit data. You can enable Auditor to continually enforce the relevant audit policies or - configure them manually: +- The global configuration mode is selected. +- The `logging enable `option is selected on the Cisco ASA device. +- The `logging host` parameter is set to the host address of the audited CiscoASA device. And UDP + port (for, example 514) is used for sending messages. - - On the Cisco ASA Device: + **NOTE:** Do not select the EMBLEM format logging for the syslog server option. - - The global configuration mode is selected. - - The `logging enable `option is selected on the Cisco ASA device. - - The `logging host` parameter is set to the host address of the audited CiscoASA device. - And UDP port (for, example 514) is used for sending messages. - - **NOTE:** Do not select the EMBLEM format logging for the syslog server option. - - - The `logging timestamp` option enabled. - - The `logging trap` option is selected from 1 to 6 inclusive. +- The `logging timestamp` option enabled. +- The `logging trap` option is selected from 1 to 6 inclusive. To configure your Cisco ASA devices, do the following: diff --git a/docs/auditor/10.8/configuration/networkdevices/ciscoios.md b/docs/auditor/10.8/configuration/networkdevices/ciscoios.md index b4f9448cd2..b9aef17b14 100644 --- a/docs/auditor/10.8/configuration/networkdevices/ciscoios.md +++ b/docs/auditor/10.8/configuration/networkdevices/ciscoios.md @@ -17,20 +17,14 @@ the [Antivirus Exclusions for Netwrix Auditor](/docs/kb/auditor/system-administration/security-hardening/antivirus-exclusions-for-netwrix-auditor) knowledge base article for additional information. -You can configure your IT Infrastructure for monitoring in one of the following ways: - -- Automatically through a monitoring plan – This is a recommended method. If you select to - automatically configure audit in the target environment, your current audit settings will be - checked on each data collection and adjusted if necessary. -- Manually – Native audit settings must be adjusted manually to ensure collecting comprehensive and - reliable audit data. You can enable Auditor to continually enforce the relevant audit policies or - configure them manually: - - - The global configuration mode is selected. - - The `logging timestamp` option enabled. - - The `logging trap` option is selected from 1 to 6 inclusive. - - The `logging host` parameter is set to the host address where the service is going to be - installed. And UDP port (for, example 514) is used for sending messages. +Configure native audit settings manually on the Cisco IOS device to ensure Netwrix Auditor +collects comprehensive and reliable audit data: + +- The global configuration mode is selected. +- The `logging timestamp` option enabled. +- The `logging trap` option is selected from 1 to 6 inclusive. +- The `logging host` parameter is set to the host address where the service is going to be + installed. And UDP port (for, example 514) is used for sending messages. To configure your Cisco IOS devices, do the following: diff --git a/docs/auditor/10.8/configuration/networkdevices/fortinetfortigate.md b/docs/auditor/10.8/configuration/networkdevices/fortinetfortigate.md index e2ec396d9b..e71df2c3c5 100644 --- a/docs/auditor/10.8/configuration/networkdevices/fortinetfortigate.md +++ b/docs/auditor/10.8/configuration/networkdevices/fortinetfortigate.md @@ -17,17 +17,8 @@ the [Antivirus Exclusions for Netwrix Auditor](/docs/kb/auditor/system-administration/security-hardening/antivirus-exclusions-for-netwrix-auditor) knowledge base article for additional information. -You can configure your IT Infrastructure for monitoring in one of the following ways: - -- Automatically through a monitoring plan – This is a recommended method. If you select to - automatically configure audit in the target environment, your current audit settings will be - checked on each data collection and adjusted if necessary. -- Manually – Native audit settings must be adjusted manually to ensure collecting comprehensive and - reliable audit data. You can enable Auditor to continually enforce the relevant audit policies or - configure them manually: - - - The target Fortinet Fortigate device must be configured via Command Line Interface (CLI) as - described below. +Configure native audit settings manually on the Fortinet FortiGate device via Command Line +Interface (CLI) to ensure Netwrix Auditor collects comprehensive and reliable audit data. To configure your Fortinet FortiGate devices, enable logging to multiple Syslog servers and configure FortiOS to send log messages to remote syslog servers in CEF format. Do one of the diff --git a/docs/auditor/10.8/configuration/networkdevices/juniper.md b/docs/auditor/10.8/configuration/networkdevices/juniper.md index 3110d05547..10efdb80dc 100644 --- a/docs/auditor/10.8/configuration/networkdevices/juniper.md +++ b/docs/auditor/10.8/configuration/networkdevices/juniper.md @@ -17,17 +17,8 @@ the [Antivirus Exclusions for Netwrix Auditor](/docs/kb/auditor/system-administration/security-hardening/antivirus-exclusions-for-netwrix-auditor) knowledge base article for additional information. -You can configure your IT Infrastructure for monitoring in one of the following ways: - -- Automatically through a monitoring plan – This is a recommended method. If you select to - automatically configure audit in the target environment, your current audit settings will be - checked on each data collection and adjusted if necessary. -- Manually – Native audit settings must be adjusted manually to ensure collecting comprehensive and - reliable audit data. You can enable Auditor to continually enforce the relevant audit policies or - configure them manually: - - - The target Juniper device must be configured via JunOS Command Line Interface (CLI) as - described below. +Configure native audit settings manually on the Juniper device via JunOS Command Line +Interface (CLI) to ensure Netwrix Auditor collects comprehensive and reliable audit data. To configure you Juniper devices, do the following: diff --git a/docs/auditor/10.8/configuration/networkdevices/paloalto.md b/docs/auditor/10.8/configuration/networkdevices/paloalto.md index 4f14fc45d3..9350081717 100644 --- a/docs/auditor/10.8/configuration/networkdevices/paloalto.md +++ b/docs/auditor/10.8/configuration/networkdevices/paloalto.md @@ -17,17 +17,9 @@ the [Antivirus Exclusions for Netwrix Auditor](/docs/kb/auditor/system-administration/security-hardening/antivirus-exclusions-for-netwrix-auditor) knowledge base article for additional information. -You can configure your IT Infrastructure for monitoring in one of the following ways: - -- Automatically through a monitoring plan – This is a recommended method. If you select to - automatically configure audit in the target environment, your current audit settings will be - checked on each data collection and adjusted if necessary. -- Manually – Native audit settings must be adjusted manually to ensure collecting comprehensive and - reliable audit data. You can enable Auditor to continually enforce the relevant audit policies or - configure them manually: - - - Create a Syslog Server profile and syslog forwarding for the target PaloAlto device via Web - Interface as described below. +Configure native audit settings manually on the PaloAlto device via Web Interface to ensure +Netwrix Auditor collects comprehensive and reliable audit data: create a Syslog Server profile and +syslog forwarding for the target PaloAlto device. To configure your PaloAlto devices, create a Syslog server profile and assign it to the log settings for each log type. diff --git a/docs/auditor/10.8/configuration/networkdevices/sonicwall.md b/docs/auditor/10.8/configuration/networkdevices/sonicwall.md index 49d7dc0148..4a90d8a2e9 100644 --- a/docs/auditor/10.8/configuration/networkdevices/sonicwall.md +++ b/docs/auditor/10.8/configuration/networkdevices/sonicwall.md @@ -17,16 +17,9 @@ the [Antivirus Exclusions for Netwrix Auditor](/docs/kb/auditor/system-administration/security-hardening/antivirus-exclusions-for-netwrix-auditor) knowledge base article for additional information. -You can configure your IT Infrastructure for monitoring in one of the following ways: - -- Automatically through a monitoring plan – This is a recommended method. If you select to - automatically configure audit in the target environment, your current audit settings will be - checked on each data collection and adjusted if necessary. -- Manually – Native audit settings must be adjusted manually to ensure collecting comprehensive and - reliable audit data. You can enable Auditor to continually enforce the relevant audit policies or - configure them manually: - - - Configure log settings, depending on your device type. +Configure native audit settings manually on the SonicWall device to ensure Netwrix Auditor +collects comprehensive and reliable audit data. Configure log settings, depending on your device +type. To configure your SonicWall devices, do the following: diff --git a/docs/auditor/10.9/configuration/networkdevices/ciscoasa.md b/docs/auditor/10.9/configuration/networkdevices/ciscoasa.md index 541311a546..f74d422ca4 100644 --- a/docs/auditor/10.9/configuration/networkdevices/ciscoasa.md +++ b/docs/auditor/10.9/configuration/networkdevices/ciscoasa.md @@ -17,26 +17,18 @@ the [Antivirus Exclusions for Netwrix Auditor](/docs/kb/auditor/system-administration/security-hardening/antivirus-exclusions-for-netwrix-auditor) knowledge base article for additional information. -You can configure your IT Infrastructure for monitoring in one of the following ways: +Configure native audit settings manually on the Cisco ASA device to ensure Netwrix Auditor +collects comprehensive and reliable audit data: -- Automatically through a monitoring plan – This is a recommended method. If you select to - automatically configure audit in the target environment, your current audit settings will be - checked on each data collection and adjusted if necessary. -- Manually – Native audit settings must be adjusted manually to ensure collecting comprehensive and - reliable audit data. You can enable Auditor to continually enforce the relevant audit policies or - configure them manually: +- The global configuration mode is selected. +- The `logging enable `option is selected on the Cisco ASA device. +- The `logging host` parameter is set to the host address of the audited CiscoASA device. And UDP + port (for, example 514) is used for sending messages. - - On the Cisco ASA Device: + **NOTE:** Do not select the EMBLEM format logging for the syslog server option. - - The global configuration mode is selected. - - The `logging enable `option is selected on the Cisco ASA device. - - The `logging host` parameter is set to the host address of the audited CiscoASA device. - And UDP port (for, example 514) is used for sending messages. - - **NOTE:** Do not select the EMBLEM format logging for the syslog server option. - - - The `logging timestamp` option enabled. - - The `logging trap` option is selected from 1 to 6 inclusive. +- The `logging timestamp` option enabled. +- The `logging trap` option is selected from 1 to 6 inclusive. To configure your Cisco ASA devices, do the following: diff --git a/docs/auditor/10.9/configuration/networkdevices/ciscoios.md b/docs/auditor/10.9/configuration/networkdevices/ciscoios.md index b4f9448cd2..b9aef17b14 100644 --- a/docs/auditor/10.9/configuration/networkdevices/ciscoios.md +++ b/docs/auditor/10.9/configuration/networkdevices/ciscoios.md @@ -17,20 +17,14 @@ the [Antivirus Exclusions for Netwrix Auditor](/docs/kb/auditor/system-administration/security-hardening/antivirus-exclusions-for-netwrix-auditor) knowledge base article for additional information. -You can configure your IT Infrastructure for monitoring in one of the following ways: - -- Automatically through a monitoring plan – This is a recommended method. If you select to - automatically configure audit in the target environment, your current audit settings will be - checked on each data collection and adjusted if necessary. -- Manually – Native audit settings must be adjusted manually to ensure collecting comprehensive and - reliable audit data. You can enable Auditor to continually enforce the relevant audit policies or - configure them manually: - - - The global configuration mode is selected. - - The `logging timestamp` option enabled. - - The `logging trap` option is selected from 1 to 6 inclusive. - - The `logging host` parameter is set to the host address where the service is going to be - installed. And UDP port (for, example 514) is used for sending messages. +Configure native audit settings manually on the Cisco IOS device to ensure Netwrix Auditor +collects comprehensive and reliable audit data: + +- The global configuration mode is selected. +- The `logging timestamp` option enabled. +- The `logging trap` option is selected from 1 to 6 inclusive. +- The `logging host` parameter is set to the host address where the service is going to be + installed. And UDP port (for, example 514) is used for sending messages. To configure your Cisco IOS devices, do the following: diff --git a/docs/auditor/10.9/configuration/networkdevices/fortinetfortigate.md b/docs/auditor/10.9/configuration/networkdevices/fortinetfortigate.md index e2ec396d9b..e71df2c3c5 100644 --- a/docs/auditor/10.9/configuration/networkdevices/fortinetfortigate.md +++ b/docs/auditor/10.9/configuration/networkdevices/fortinetfortigate.md @@ -17,17 +17,8 @@ the [Antivirus Exclusions for Netwrix Auditor](/docs/kb/auditor/system-administration/security-hardening/antivirus-exclusions-for-netwrix-auditor) knowledge base article for additional information. -You can configure your IT Infrastructure for monitoring in one of the following ways: - -- Automatically through a monitoring plan – This is a recommended method. If you select to - automatically configure audit in the target environment, your current audit settings will be - checked on each data collection and adjusted if necessary. -- Manually – Native audit settings must be adjusted manually to ensure collecting comprehensive and - reliable audit data. You can enable Auditor to continually enforce the relevant audit policies or - configure them manually: - - - The target Fortinet Fortigate device must be configured via Command Line Interface (CLI) as - described below. +Configure native audit settings manually on the Fortinet FortiGate device via Command Line +Interface (CLI) to ensure Netwrix Auditor collects comprehensive and reliable audit data. To configure your Fortinet FortiGate devices, enable logging to multiple Syslog servers and configure FortiOS to send log messages to remote syslog servers in CEF format. Do one of the diff --git a/docs/auditor/10.9/configuration/networkdevices/juniper.md b/docs/auditor/10.9/configuration/networkdevices/juniper.md index 6ebc05919d..5808dc5fff 100644 --- a/docs/auditor/10.9/configuration/networkdevices/juniper.md +++ b/docs/auditor/10.9/configuration/networkdevices/juniper.md @@ -17,17 +17,8 @@ the [Antivirus Exclusions for Netwrix Auditor](/docs/kb/auditor/system-administration/security-hardening/antivirus-exclusions-for-netwrix-auditor) knowledge base article for additional information. -You can configure your IT Infrastructure for monitoring in one of the following ways: - -- Automatically through a monitoring plan – This is a recommended method. If you select to - automatically configure audit in the target environment, your current audit settings will be - checked on each data collection and adjusted if necessary. -- Manually – Native audit settings must be adjusted manually to ensure collecting comprehensive and - reliable audit data. You can enable Auditor to continually enforce the relevant audit policies or - configure them manually: - - - The target Juniper device must be configured via JunOS Command Line Interface (CLI) as - described below. +Configure native audit settings manually on the Juniper device via JunOS Command Line +Interface (CLI) to ensure Netwrix Auditor collects comprehensive and reliable audit data. To configure you Juniper devices, do the following: diff --git a/docs/auditor/10.9/configuration/networkdevices/paloalto.md b/docs/auditor/10.9/configuration/networkdevices/paloalto.md index 4f14fc45d3..9350081717 100644 --- a/docs/auditor/10.9/configuration/networkdevices/paloalto.md +++ b/docs/auditor/10.9/configuration/networkdevices/paloalto.md @@ -17,17 +17,9 @@ the [Antivirus Exclusions for Netwrix Auditor](/docs/kb/auditor/system-administration/security-hardening/antivirus-exclusions-for-netwrix-auditor) knowledge base article for additional information. -You can configure your IT Infrastructure for monitoring in one of the following ways: - -- Automatically through a monitoring plan – This is a recommended method. If you select to - automatically configure audit in the target environment, your current audit settings will be - checked on each data collection and adjusted if necessary. -- Manually – Native audit settings must be adjusted manually to ensure collecting comprehensive and - reliable audit data. You can enable Auditor to continually enforce the relevant audit policies or - configure them manually: - - - Create a Syslog Server profile and syslog forwarding for the target PaloAlto device via Web - Interface as described below. +Configure native audit settings manually on the PaloAlto device via Web Interface to ensure +Netwrix Auditor collects comprehensive and reliable audit data: create a Syslog Server profile and +syslog forwarding for the target PaloAlto device. To configure your PaloAlto devices, create a Syslog server profile and assign it to the log settings for each log type. diff --git a/docs/auditor/10.9/configuration/networkdevices/sonicwall.md b/docs/auditor/10.9/configuration/networkdevices/sonicwall.md index 49d7dc0148..4a90d8a2e9 100644 --- a/docs/auditor/10.9/configuration/networkdevices/sonicwall.md +++ b/docs/auditor/10.9/configuration/networkdevices/sonicwall.md @@ -17,16 +17,9 @@ the [Antivirus Exclusions for Netwrix Auditor](/docs/kb/auditor/system-administration/security-hardening/antivirus-exclusions-for-netwrix-auditor) knowledge base article for additional information. -You can configure your IT Infrastructure for monitoring in one of the following ways: - -- Automatically through a monitoring plan – This is a recommended method. If you select to - automatically configure audit in the target environment, your current audit settings will be - checked on each data collection and adjusted if necessary. -- Manually – Native audit settings must be adjusted manually to ensure collecting comprehensive and - reliable audit data. You can enable Auditor to continually enforce the relevant audit policies or - configure them manually: - - - Configure log settings, depending on your device type. +Configure native audit settings manually on the SonicWall device to ensure Netwrix Auditor +collects comprehensive and reliable audit data. Configure log settings, depending on your device +type. To configure your SonicWall devices, do the following: From b5693fa6b9d7ccbf96adad730af6429b0abd863f Mon Sep 17 00:00:00 2001 From: "claude[bot]" <41898282+claude[bot]@users.noreply.github.com> Date: Tue, 18 Aug 2026 19:26:06 +0000 Subject: [PATCH 2/9] fix(vale): auto-fix style issues (Vale + Dale) --- .../configuration/networkdevices/ciscoasa.md | 25 +++++++++---------- .../configuration/networkdevices/ciscoios.md | 21 ++++++++-------- .../networkdevices/fortinetfortigate.md | 11 ++++---- .../configuration/networkdevices/juniper.md | 12 ++++----- .../configuration/networkdevices/paloalto.md | 18 ++++++------- .../configuration/networkdevices/sonicwall.md | 19 +++++++------- .../configuration/networkdevices/ciscoasa.md | 25 +++++++++---------- .../configuration/networkdevices/ciscoios.md | 21 ++++++++-------- .../networkdevices/fortinetfortigate.md | 11 ++++---- .../configuration/networkdevices/juniper.md | 12 ++++----- .../configuration/networkdevices/paloalto.md | 18 ++++++------- .../configuration/networkdevices/sonicwall.md | 19 +++++++------- .../configuration/networkdevices/ciscoasa.md | 25 +++++++++---------- .../configuration/networkdevices/ciscoios.md | 21 ++++++++-------- .../networkdevices/fortinetfortigate.md | 11 ++++---- .../configuration/networkdevices/juniper.md | 12 ++++----- .../configuration/networkdevices/paloalto.md | 18 ++++++------- .../configuration/networkdevices/sonicwall.md | 19 +++++++------- 18 files changed, 150 insertions(+), 168 deletions(-) diff --git a/docs/auditor/10.7/configuration/networkdevices/ciscoasa.md b/docs/auditor/10.7/configuration/networkdevices/ciscoasa.md index f74d422ca4..2b8e9a3279 100644 --- a/docs/auditor/10.7/configuration/networkdevices/ciscoasa.md +++ b/docs/auditor/10.7/configuration/networkdevices/ciscoasa.md @@ -9,26 +9,25 @@ sidebar_position: 20 Netwrix Auditor relies on native logs for collecting audit data. Therefore, successful change and access auditing requires a certain configuration of native audit settings in the audited environment and on the Auditor console computer. Configuring your IT infrastructure may also include enabling -certain built-in Windows services, etc. Proper audit configuration is required to ensure audit data -integrity, otherwise your change reports may contain warnings, errors or incomplete audit data. +certain built-in Windows services, etc. Proper audit configuration ensures audit data integrity; +otherwise, your change reports may contain warnings, errors, or incomplete audit data. -**CAUTION:** Folder associated with Netwrix Auditor must be excluded from antivirus scanning. See -the +**CAUTION:** Exclude the folder associated with Netwrix Auditor from antivirus scanning. See the [Antivirus Exclusions for Netwrix Auditor](/docs/kb/auditor/system-administration/security-hardening/antivirus-exclusions-for-netwrix-auditor) knowledge base article for additional information. Configure native audit settings manually on the Cisco ASA device to ensure Netwrix Auditor collects comprehensive and reliable audit data: -- The global configuration mode is selected. -- The `logging enable `option is selected on the Cisco ASA device. -- The `logging host` parameter is set to the host address of the audited CiscoASA device. And UDP - port (for, example 514) is used for sending messages. +- Select the global configuration mode. +- Select the `logging enable` option on the Cisco ASA device. +- Set the `logging host` parameter to the host address of the audited Cisco ASA device, and use a + UDP port (for example, 514) to send messages. - **NOTE:** Do not select the EMBLEM format logging for the syslog server option. + **NOTE:** Don't select the EMBLEM format logging for the syslog server option. -- The `logging timestamp` option enabled. -- The `logging trap` option is selected from 1 to 6 inclusive. +- Enable the `logging timestamp` option. +- Select the `logging trap` option from 1 to 6 inclusive. To configure your Cisco ASA devices, do the following: @@ -45,12 +44,12 @@ To configure your Cisco ASA devices, do the following: hostname(config)# logging enable 4. Set the IP address of the computer that hosts Netwrix Auditor Server as the `logging host` - parameter. And make sure that the UDP port is used for sending syslog messages (e.g., 514 UDP + parameter, and ensure that the device uses a UDP port to send syslog messages (e.g., 514 UDP port). For example: hostname(config)# logging host `` - Do not select the EMBLEM format logging for the syslog server option. + Don't select the EMBLEM format logging for the syslog server option. 5. Enable the `logging timestamp` option. For example: diff --git a/docs/auditor/10.7/configuration/networkdevices/ciscoios.md b/docs/auditor/10.7/configuration/networkdevices/ciscoios.md index b9aef17b14..eb6cefe6fb 100644 --- a/docs/auditor/10.7/configuration/networkdevices/ciscoios.md +++ b/docs/auditor/10.7/configuration/networkdevices/ciscoios.md @@ -9,22 +9,21 @@ sidebar_position: 30 Netwrix Auditor relies on native logs for collecting audit data. Therefore, successful change and access auditing requires a certain configuration of native audit settings in the audited environment and on the Auditor console computer. Configuring your IT infrastructure may also include enabling -certain built-in Windows services, etc. Proper audit configuration is required to ensure audit data -integrity, otherwise your change reports may contain warnings, errors or incomplete audit data. +certain built-in Windows services, etc. Proper audit configuration ensures audit data integrity; +otherwise, your change reports may contain warnings, errors, or incomplete audit data. -**CAUTION:** Folder associated with Netwrix Auditor must be excluded from antivirus scanning. See -the +**CAUTION:** Exclude the folder associated with Netwrix Auditor from antivirus scanning. See the [Antivirus Exclusions for Netwrix Auditor](/docs/kb/auditor/system-administration/security-hardening/antivirus-exclusions-for-netwrix-auditor) knowledge base article for additional information. Configure native audit settings manually on the Cisco IOS device to ensure Netwrix Auditor collects comprehensive and reliable audit data: -- The global configuration mode is selected. -- The `logging timestamp` option enabled. -- The `logging trap` option is selected from 1 to 6 inclusive. -- The `logging host` parameter is set to the host address where the service is going to be - installed. And UDP port (for, example 514) is used for sending messages. +- Select the global configuration mode. +- Enable the `logging timestamp` option. +- Select the `logging trap` option from 1 to 6 inclusive. +- Set the `logging host` parameter to the host address where you plan to install the service, and + use a UDP port (for example, 514) to send messages. To configure your Cisco IOS devices, do the following: @@ -42,8 +41,8 @@ To configure your Cisco IOS devices, do the following: Router# logging trap 5 -5. Set the IP address of the Netwrix Auditor Server as the logging host parameter. And make sure - that the UDP port is used for sending syslog messages (e.g., 514 UDP port). For example: +5. Set the IP address of the Netwrix Auditor Server as the logging host parameter, and ensure that + the device uses a UDP port to send syslog messages (e.g., 514 UDP port). For example: Router# logging 192.168.1.5 diff --git a/docs/auditor/10.7/configuration/networkdevices/fortinetfortigate.md b/docs/auditor/10.7/configuration/networkdevices/fortinetfortigate.md index e71df2c3c5..08f616ae52 100644 --- a/docs/auditor/10.7/configuration/networkdevices/fortinetfortigate.md +++ b/docs/auditor/10.7/configuration/networkdevices/fortinetfortigate.md @@ -9,11 +9,10 @@ sidebar_position: 60 Netwrix Auditor relies on native logs for collecting audit data. Therefore, successful change and access auditing requires a certain configuration of native audit settings in the audited environment and on the Auditor console computer. Configuring your IT infrastructure may also include enabling -certain built-in Windows services, etc. Proper audit configuration is required to ensure audit data -integrity, otherwise your change reports may contain warnings, errors or incomplete audit data. +certain built-in Windows services, etc. Proper audit configuration ensures audit data integrity; +otherwise, your change reports may contain warnings, errors, or incomplete audit data. -**CAUTION:** Folder associated with Netwrix Auditor must be excluded from antivirus scanning. See -the +**CAUTION:** Exclude the folder associated with Netwrix Auditor from antivirus scanning. See the [Antivirus Exclusions for Netwrix Auditor](/docs/kb/auditor/system-administration/security-hardening/antivirus-exclusions-for-netwrix-auditor) knowledge base article for additional information. @@ -21,8 +20,8 @@ Configure native audit settings manually on the Fortinet FortiGate device via Co Interface (CLI) to ensure Netwrix Auditor collects comprehensive and reliable audit data. To configure your Fortinet FortiGate devices, enable logging to multiple Syslog servers and -configure FortiOS to send log messages to remote syslog servers in CEF format. Do one of the -following: +configure FortiOS to send log messages to remote syslog servers in Common Event Format (CEF). Do +one of the following: - To configure Fortinet FortiGate devices via Command Line Interface - To configure Fortinet FortiGate devices through the Fortigate Management Console diff --git a/docs/auditor/10.7/configuration/networkdevices/juniper.md b/docs/auditor/10.7/configuration/networkdevices/juniper.md index fb640cec8e..3861e900a7 100644 --- a/docs/auditor/10.7/configuration/networkdevices/juniper.md +++ b/docs/auditor/10.7/configuration/networkdevices/juniper.md @@ -9,11 +9,10 @@ sidebar_position: 80 Netwrix Auditor relies on native logs for collecting audit data. Therefore, successful change and access auditing requires a certain configuration of native audit settings in the audited environment and on the Auditor console computer. Configuring your IT infrastructure may also include enabling -certain built-in Windows services, etc. Proper audit configuration is required to ensure audit data -integrity, otherwise your change reports may contain warnings, errors or incomplete audit data. +certain built-in Windows services, etc. Proper audit configuration ensures audit data integrity; +otherwise, your change reports may contain warnings, errors, or incomplete audit data. -**CAUTION:** Folder associated with Netwrix Auditor must be excluded from antivirus scanning. See -the +**CAUTION:** Exclude the folder associated with Netwrix Auditor from antivirus scanning. See the [Antivirus Exclusions for Netwrix Auditor](/docs/kb/auditor/system-administration/security-hardening/antivirus-exclusions-for-netwrix-auditor) knowledge base article for additional information. @@ -29,14 +28,13 @@ To configure you Juniper devices, do the following: # set system syslog host `` any info - where `` is the IP address of the computer where Netwrix Auditor Server is - installed. + where `` is the IP address of the computer that hosts Netwrix Auditor Server. # set system syslog host `` port `` where - `` is the IP address of the computer where Netwrix Auditor Server is installed + `` is the IP address of the computer that hosts Netwrix Auditor Server AND diff --git a/docs/auditor/10.7/configuration/networkdevices/paloalto.md b/docs/auditor/10.7/configuration/networkdevices/paloalto.md index 9350081717..38969cf4fa 100644 --- a/docs/auditor/10.7/configuration/networkdevices/paloalto.md +++ b/docs/auditor/10.7/configuration/networkdevices/paloalto.md @@ -9,11 +9,10 @@ sidebar_position: 90 Netwrix Auditor relies on native logs for collecting audit data. Therefore, successful change and access auditing requires a certain configuration of native audit settings in the audited environment and on the Auditor console computer. Configuring your IT infrastructure may also include enabling -certain built-in Windows services, etc. Proper audit configuration is required to ensure audit data -integrity, otherwise your change reports may contain warnings, errors or incomplete audit data. +certain built-in Windows services, etc. Proper audit configuration ensures audit data integrity; +otherwise, your change reports may contain warnings, errors, or incomplete audit data. -**CAUTION:** Folder associated with Netwrix Auditor must be excluded from antivirus scanning. See -the +**CAUTION:** Exclude the folder associated with Netwrix Auditor from antivirus scanning. See the [Antivirus Exclusions for Netwrix Auditor](/docs/kb/auditor/system-administration/security-hardening/antivirus-exclusions-for-netwrix-auditor) knowledge base article for additional information. @@ -24,7 +23,7 @@ syslog forwarding for the target PaloAlto device. To configure your PaloAlto devices, create a Syslog server profile and assign it to the log settings for each log type. -Follow the steps to configure a Syslog server profile. +## Configure a Syslog server profile **Step 1 –** Connect to your PaloAlto device: launch an Internet browser and enter the IP address of the firewall in the URL field (https://``). @@ -44,19 +43,20 @@ the firewall in the URL field (https://``). | Format | Select IETF. | | Facility | Netwrix recommends using default values. | -Follow the steps to configure syslog forwarding. +## Configure syslog forwarding **Step 1 –** In the Web Interface, navigate to **Device** > **Log Settings**. **Step 2 –** For System, Config, and User ID logs, click Add and enter unique name of your syslog server. -**Step 3 –** On the syslog panel, click Add and select the syslog profile you created above. +**Step 3 –** On the syslog panel, click Add and select the syslog profile you created in +[Configure a Syslog server profile](#configure-a-syslog-server-profile). **Step 4 –** Click **Commit** and review the logs on the syslog server. -**NOTE:** After configuring the monitoring plan, Netwrix Auditor will listen to the logs forwarded -by the Palo Alto device. +**NOTE:** After you configure the monitoring plan, Netwrix Auditor listens to the logs forwarded by +the Palo Alto device. ## PaloAlto Devices diff --git a/docs/auditor/10.7/configuration/networkdevices/sonicwall.md b/docs/auditor/10.7/configuration/networkdevices/sonicwall.md index 4a90d8a2e9..176afe7b6b 100644 --- a/docs/auditor/10.7/configuration/networkdevices/sonicwall.md +++ b/docs/auditor/10.7/configuration/networkdevices/sonicwall.md @@ -9,11 +9,10 @@ sidebar_position: 110 Netwrix Auditor relies on native logs for collecting audit data. Therefore, successful change and access auditing requires a certain configuration of native audit settings in the audited environment and on the Auditor console computer. Configuring your IT infrastructure may also include enabling -certain built-in Windows services, etc. Proper audit configuration is required to ensure audit data -integrity, otherwise your change reports may contain warnings, errors or incomplete audit data. +certain built-in Windows services, etc. Proper audit configuration ensures audit data integrity; +otherwise, your change reports may contain warnings, errors, or incomplete audit data. -**CAUTION:** Folder associated with Netwrix Auditor must be excluded from antivirus scanning. See -the +**CAUTION:** Exclude the folder associated with Netwrix Auditor from antivirus scanning. See the [Antivirus Exclusions for Netwrix Auditor](/docs/kb/auditor/system-administration/security-hardening/antivirus-exclusions-for-netwrix-auditor) knowledge base article for additional information. @@ -93,8 +92,8 @@ To configure SonicWall NS series box. 10. Provide name and IP address of the new object. 11. Click OK. -12. In the Add Syslog Server dialog, find the IP address you specified on the step 10 in the Name or - IP Address list. +12. In the Add Syslog Server dialog, in the Name or IP Address list, find the IP address you + specified in step 10. 13. Click OK. 14. Click Save. @@ -105,16 +104,16 @@ Review a full list of object types Netwrix Auditor can collect on SonicWall netw | Object type | Actions | Event ID | | ------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Logon | - Successful logon | - User login from an internal zone allowed - User login successful - XAUTH Succeeded with VPN - VPN zone remote user login allowed - WAN zone remote user login allowed - PPP: Authentication successful - Local Authentication Success - RADIUS/LDAP Authentication Success - Successful authentication received for Remotely Triggered - IKEv2 Authentication successful - SSL VPN zone remote user login allowed | -| - Failed logon | - User login denied - User login failed - XAUTH Failed with VPN - L2TP PPP Authentication Failed - check username / password - RADIUS/LDAP reports Authentication Failure - Local Authentication Failure - User login to Administration Portal denied - User login failure rate exceeded - User Name authentication Failure locally - ISAKMP_AUTH_FAILED - Guest service limit reached - Guest login denied - Incorrect authentication received for Remotely Triggered - Authentication Timeout during Remotely Triggered - Problem occurred during user group membership retrieval - An error has occurred while sending your - IPsec Authentication Failed | | +| - Failed logon | - User login denied - User login failed - XAUTH Failed with VPN - L2TP PPP Authentication Failed - check username / password - RADIUS/LDAP reports Authentication Failure - Local Authentication Failure - User log in to Administration Portal denied - User login failure rate exceeded - User Name authentication Failure locally - ISAKMP_AUTH_FAILED - Guest service limit reached - Guest login denied - Incorrect authentication received for Remotely Triggered - Authentication Timeout during Remotely Triggered - Problem occurred during user group membership retrieval - An error has occurred while sending your - IPsec Authentication Failed | | | - Logoff | - User logged out - logged out - Guest Session Timeout - Guest Account Timeout - Guest Idle Timeout - Guest traffic quota exceeded | | | Authentication | - Successful Logon | - Administrator login allowed - CLI administrator login allowed - VPN zone administrator login allowed - WAN zone administrator login allowed - Configuration mode administration session started - Read-only mode GUI administration session started - Non-config mode GUI administration session started - User login successful - Session Start: - EventMessage: Session Start Success | -| - Failed Logon | - Administrator login denied - CLI administrator login denied due to bad credentials - User login failed - The account has been disabled for - is not permitted for this Web App - Authentication for user - Authentication failed - maximum authentication attempts exceeded for - EventMessage: Session Start Failed | | +| - Failed Logon | - Administrator login denied - CLI administrator login denied due to bad credentials - User login failed - The account has been disabled for - isn't permitted for this Web App - Authentication for user - Authentication failed - maximum authentication attempts exceeded for - EventMessage: Session Start Failed | | | - Logoff | - Administrator logged out - CLI administrator logged out - Configuration mode administration session ended - GUI administration session ended - Logged out - Session End: - EventMessage: Session End - Command='Tunnel' | | | Configuration | - Add / Added (Failed attempt) | - m=1333 - Scheduled settings generated - A new default Self-Signed certificate was generated successfully - Scheduled Tech Support Report generated - Restarted Tech Support Report generated | | - Modified / Modify (Failed attempt) | - Mail attachment disabled - Watch and report possible SYN floods - Watch and proxy WAN connections when under attack - Always proxy WAN connections - SYN Flood blacklisting enabled by user - SYN Flood blacklisting disabled by user - Administrator name changed - VPN disabled by administrator - VPN enabled by administrator - WLAN disabled by administrator - WLAN enabled by administrator - WLAN disabled by schedule - WLAN enabled by schedule - is added into Group - is removed from Group - m=1334 - Update administrator/user lockout params - Settings imported - Critical Operating System Update failed - msg=\"WAF restarted - HTTP(S) Cache settings were updated - database has been updated - Web Server Fingerprint Protection enforced - About to reconfigure service: - Finished applying configuration changes - Started - Start failed - Stopped | | -| - Read / Read (Failed attempt) | - m=1203 - m=1204 - Problem loading the URL list - Registration Update Needed, Please restore your existing security service subscriptions - Failed to synchronize license information with Licensing Server - Current settings exported - Error sending - settings sent successfully - Automated scheduled settings successful - Scheduled settings downloaded - Tech Support Report - Tech Support Report sent successfully - Loaded WAF signature database successfully - Error sending - logs sent out successfully | | +| - Read / Read (Failed attempt) | - m=1203 - m=1204 - Problem loading the URL list - Registration Update Needed, restore your existing security service subscriptions - Failed to synchronize license information with Licensing Server - Current settings exported - Error sending - settings sent successfully - Automated scheduled settings successful - Scheduled settings downloaded - Tech Support Report - Tech Support Report sent successfully - Loaded WAF signature database successfully - Error sending - logs sent out successfully | | | | - Remove / Removed (Failed attempt) | - Scheduled settings deleted - Oldest scheduled Tech Support Report deleted - has been deleted - Event Logs cleared - Audit Logs cleared - Access Logs cleared - Deleting log files - Deleting core files - Deleting snapshots older | -| Device state | - Modified / Modify (Failed attempt) | - Registration Update Needed, Please restore your existing security service subscriptions - Intrusion Prevention (IDP) subscription has expired - Failed to synchronize license information with Licensing Server | +| Device state | - Modified / Modify (Failed attempt) | - Registration Update Needed, restore your existing security service subscriptions - Intrusion Prevention (IDP) subscription has expired - Failed to synchronize license information with Licensing Server | | Folder | - Add / Added (Failed attempt) | - Request='GET /cgi-bin/sonicfiles?RacNumber=9&Arg1= | | - Read / Read (Failed attempt) | - Request='GET /cgi-bin/sonicfiles?RacNumber=16&Arg1= | | | - Remove / Removed (Failed attempt) | - Request='GET /cgi-bin/sonicfiles?RacNumber=13&Arg1= | | diff --git a/docs/auditor/10.8/configuration/networkdevices/ciscoasa.md b/docs/auditor/10.8/configuration/networkdevices/ciscoasa.md index f74d422ca4..2b8e9a3279 100644 --- a/docs/auditor/10.8/configuration/networkdevices/ciscoasa.md +++ b/docs/auditor/10.8/configuration/networkdevices/ciscoasa.md @@ -9,26 +9,25 @@ sidebar_position: 20 Netwrix Auditor relies on native logs for collecting audit data. Therefore, successful change and access auditing requires a certain configuration of native audit settings in the audited environment and on the Auditor console computer. Configuring your IT infrastructure may also include enabling -certain built-in Windows services, etc. Proper audit configuration is required to ensure audit data -integrity, otherwise your change reports may contain warnings, errors or incomplete audit data. +certain built-in Windows services, etc. Proper audit configuration ensures audit data integrity; +otherwise, your change reports may contain warnings, errors, or incomplete audit data. -**CAUTION:** Folder associated with Netwrix Auditor must be excluded from antivirus scanning. See -the +**CAUTION:** Exclude the folder associated with Netwrix Auditor from antivirus scanning. See the [Antivirus Exclusions for Netwrix Auditor](/docs/kb/auditor/system-administration/security-hardening/antivirus-exclusions-for-netwrix-auditor) knowledge base article for additional information. Configure native audit settings manually on the Cisco ASA device to ensure Netwrix Auditor collects comprehensive and reliable audit data: -- The global configuration mode is selected. -- The `logging enable `option is selected on the Cisco ASA device. -- The `logging host` parameter is set to the host address of the audited CiscoASA device. And UDP - port (for, example 514) is used for sending messages. +- Select the global configuration mode. +- Select the `logging enable` option on the Cisco ASA device. +- Set the `logging host` parameter to the host address of the audited Cisco ASA device, and use a + UDP port (for example, 514) to send messages. - **NOTE:** Do not select the EMBLEM format logging for the syslog server option. + **NOTE:** Don't select the EMBLEM format logging for the syslog server option. -- The `logging timestamp` option enabled. -- The `logging trap` option is selected from 1 to 6 inclusive. +- Enable the `logging timestamp` option. +- Select the `logging trap` option from 1 to 6 inclusive. To configure your Cisco ASA devices, do the following: @@ -45,12 +44,12 @@ To configure your Cisco ASA devices, do the following: hostname(config)# logging enable 4. Set the IP address of the computer that hosts Netwrix Auditor Server as the `logging host` - parameter. And make sure that the UDP port is used for sending syslog messages (e.g., 514 UDP + parameter, and ensure that the device uses a UDP port to send syslog messages (e.g., 514 UDP port). For example: hostname(config)# logging host `` - Do not select the EMBLEM format logging for the syslog server option. + Don't select the EMBLEM format logging for the syslog server option. 5. Enable the `logging timestamp` option. For example: diff --git a/docs/auditor/10.8/configuration/networkdevices/ciscoios.md b/docs/auditor/10.8/configuration/networkdevices/ciscoios.md index b9aef17b14..eb6cefe6fb 100644 --- a/docs/auditor/10.8/configuration/networkdevices/ciscoios.md +++ b/docs/auditor/10.8/configuration/networkdevices/ciscoios.md @@ -9,22 +9,21 @@ sidebar_position: 30 Netwrix Auditor relies on native logs for collecting audit data. Therefore, successful change and access auditing requires a certain configuration of native audit settings in the audited environment and on the Auditor console computer. Configuring your IT infrastructure may also include enabling -certain built-in Windows services, etc. Proper audit configuration is required to ensure audit data -integrity, otherwise your change reports may contain warnings, errors or incomplete audit data. +certain built-in Windows services, etc. Proper audit configuration ensures audit data integrity; +otherwise, your change reports may contain warnings, errors, or incomplete audit data. -**CAUTION:** Folder associated with Netwrix Auditor must be excluded from antivirus scanning. See -the +**CAUTION:** Exclude the folder associated with Netwrix Auditor from antivirus scanning. See the [Antivirus Exclusions for Netwrix Auditor](/docs/kb/auditor/system-administration/security-hardening/antivirus-exclusions-for-netwrix-auditor) knowledge base article for additional information. Configure native audit settings manually on the Cisco IOS device to ensure Netwrix Auditor collects comprehensive and reliable audit data: -- The global configuration mode is selected. -- The `logging timestamp` option enabled. -- The `logging trap` option is selected from 1 to 6 inclusive. -- The `logging host` parameter is set to the host address where the service is going to be - installed. And UDP port (for, example 514) is used for sending messages. +- Select the global configuration mode. +- Enable the `logging timestamp` option. +- Select the `logging trap` option from 1 to 6 inclusive. +- Set the `logging host` parameter to the host address where you plan to install the service, and + use a UDP port (for example, 514) to send messages. To configure your Cisco IOS devices, do the following: @@ -42,8 +41,8 @@ To configure your Cisco IOS devices, do the following: Router# logging trap 5 -5. Set the IP address of the Netwrix Auditor Server as the logging host parameter. And make sure - that the UDP port is used for sending syslog messages (e.g., 514 UDP port). For example: +5. Set the IP address of the Netwrix Auditor Server as the logging host parameter, and ensure that + the device uses a UDP port to send syslog messages (e.g., 514 UDP port). For example: Router# logging 192.168.1.5 diff --git a/docs/auditor/10.8/configuration/networkdevices/fortinetfortigate.md b/docs/auditor/10.8/configuration/networkdevices/fortinetfortigate.md index e71df2c3c5..08f616ae52 100644 --- a/docs/auditor/10.8/configuration/networkdevices/fortinetfortigate.md +++ b/docs/auditor/10.8/configuration/networkdevices/fortinetfortigate.md @@ -9,11 +9,10 @@ sidebar_position: 60 Netwrix Auditor relies on native logs for collecting audit data. Therefore, successful change and access auditing requires a certain configuration of native audit settings in the audited environment and on the Auditor console computer. Configuring your IT infrastructure may also include enabling -certain built-in Windows services, etc. Proper audit configuration is required to ensure audit data -integrity, otherwise your change reports may contain warnings, errors or incomplete audit data. +certain built-in Windows services, etc. Proper audit configuration ensures audit data integrity; +otherwise, your change reports may contain warnings, errors, or incomplete audit data. -**CAUTION:** Folder associated with Netwrix Auditor must be excluded from antivirus scanning. See -the +**CAUTION:** Exclude the folder associated with Netwrix Auditor from antivirus scanning. See the [Antivirus Exclusions for Netwrix Auditor](/docs/kb/auditor/system-administration/security-hardening/antivirus-exclusions-for-netwrix-auditor) knowledge base article for additional information. @@ -21,8 +20,8 @@ Configure native audit settings manually on the Fortinet FortiGate device via Co Interface (CLI) to ensure Netwrix Auditor collects comprehensive and reliable audit data. To configure your Fortinet FortiGate devices, enable logging to multiple Syslog servers and -configure FortiOS to send log messages to remote syslog servers in CEF format. Do one of the -following: +configure FortiOS to send log messages to remote syslog servers in Common Event Format (CEF). Do +one of the following: - To configure Fortinet FortiGate devices via Command Line Interface - To configure Fortinet FortiGate devices through the Fortigate Management Console diff --git a/docs/auditor/10.8/configuration/networkdevices/juniper.md b/docs/auditor/10.8/configuration/networkdevices/juniper.md index 10efdb80dc..b56f70dc1b 100644 --- a/docs/auditor/10.8/configuration/networkdevices/juniper.md +++ b/docs/auditor/10.8/configuration/networkdevices/juniper.md @@ -9,11 +9,10 @@ sidebar_position: 80 Netwrix Auditor relies on native logs for collecting audit data. Therefore, successful change and access auditing requires a certain configuration of native audit settings in the audited environment and on the Auditor console computer. Configuring your IT infrastructure may also include enabling -certain built-in Windows services, etc. Proper audit configuration is required to ensure audit data -integrity, otherwise your change reports may contain warnings, errors or incomplete audit data. +certain built-in Windows services, etc. Proper audit configuration ensures audit data integrity; +otherwise, your change reports may contain warnings, errors, or incomplete audit data. -**CAUTION:** Folder associated with Netwrix Auditor must be excluded from antivirus scanning. See -the +**CAUTION:** Exclude the folder associated with Netwrix Auditor from antivirus scanning. See the [Antivirus Exclusions for Netwrix Auditor](/docs/kb/auditor/system-administration/security-hardening/antivirus-exclusions-for-netwrix-auditor) knowledge base article for additional information. @@ -29,14 +28,13 @@ To configure you Juniper devices, do the following: # set system syslog host `` any info - where `` is the IP address of the computer where Netwrix Auditor Server is - installed. + where `` is the IP address of the computer that hosts Netwrix Auditor Server. # set system syslog host `` port `` where - `` is the IP address of the computer where Netwrix Auditor Server is installed + `` is the IP address of the computer that hosts Netwrix Auditor Server AND diff --git a/docs/auditor/10.8/configuration/networkdevices/paloalto.md b/docs/auditor/10.8/configuration/networkdevices/paloalto.md index 9350081717..38969cf4fa 100644 --- a/docs/auditor/10.8/configuration/networkdevices/paloalto.md +++ b/docs/auditor/10.8/configuration/networkdevices/paloalto.md @@ -9,11 +9,10 @@ sidebar_position: 90 Netwrix Auditor relies on native logs for collecting audit data. Therefore, successful change and access auditing requires a certain configuration of native audit settings in the audited environment and on the Auditor console computer. Configuring your IT infrastructure may also include enabling -certain built-in Windows services, etc. Proper audit configuration is required to ensure audit data -integrity, otherwise your change reports may contain warnings, errors or incomplete audit data. +certain built-in Windows services, etc. Proper audit configuration ensures audit data integrity; +otherwise, your change reports may contain warnings, errors, or incomplete audit data. -**CAUTION:** Folder associated with Netwrix Auditor must be excluded from antivirus scanning. See -the +**CAUTION:** Exclude the folder associated with Netwrix Auditor from antivirus scanning. See the [Antivirus Exclusions for Netwrix Auditor](/docs/kb/auditor/system-administration/security-hardening/antivirus-exclusions-for-netwrix-auditor) knowledge base article for additional information. @@ -24,7 +23,7 @@ syslog forwarding for the target PaloAlto device. To configure your PaloAlto devices, create a Syslog server profile and assign it to the log settings for each log type. -Follow the steps to configure a Syslog server profile. +## Configure a Syslog server profile **Step 1 –** Connect to your PaloAlto device: launch an Internet browser and enter the IP address of the firewall in the URL field (https://``). @@ -44,19 +43,20 @@ the firewall in the URL field (https://``). | Format | Select IETF. | | Facility | Netwrix recommends using default values. | -Follow the steps to configure syslog forwarding. +## Configure syslog forwarding **Step 1 –** In the Web Interface, navigate to **Device** > **Log Settings**. **Step 2 –** For System, Config, and User ID logs, click Add and enter unique name of your syslog server. -**Step 3 –** On the syslog panel, click Add and select the syslog profile you created above. +**Step 3 –** On the syslog panel, click Add and select the syslog profile you created in +[Configure a Syslog server profile](#configure-a-syslog-server-profile). **Step 4 –** Click **Commit** and review the logs on the syslog server. -**NOTE:** After configuring the monitoring plan, Netwrix Auditor will listen to the logs forwarded -by the Palo Alto device. +**NOTE:** After you configure the monitoring plan, Netwrix Auditor listens to the logs forwarded by +the Palo Alto device. ## PaloAlto Devices diff --git a/docs/auditor/10.8/configuration/networkdevices/sonicwall.md b/docs/auditor/10.8/configuration/networkdevices/sonicwall.md index 4a90d8a2e9..176afe7b6b 100644 --- a/docs/auditor/10.8/configuration/networkdevices/sonicwall.md +++ b/docs/auditor/10.8/configuration/networkdevices/sonicwall.md @@ -9,11 +9,10 @@ sidebar_position: 110 Netwrix Auditor relies on native logs for collecting audit data. Therefore, successful change and access auditing requires a certain configuration of native audit settings in the audited environment and on the Auditor console computer. Configuring your IT infrastructure may also include enabling -certain built-in Windows services, etc. Proper audit configuration is required to ensure audit data -integrity, otherwise your change reports may contain warnings, errors or incomplete audit data. +certain built-in Windows services, etc. Proper audit configuration ensures audit data integrity; +otherwise, your change reports may contain warnings, errors, or incomplete audit data. -**CAUTION:** Folder associated with Netwrix Auditor must be excluded from antivirus scanning. See -the +**CAUTION:** Exclude the folder associated with Netwrix Auditor from antivirus scanning. See the [Antivirus Exclusions for Netwrix Auditor](/docs/kb/auditor/system-administration/security-hardening/antivirus-exclusions-for-netwrix-auditor) knowledge base article for additional information. @@ -93,8 +92,8 @@ To configure SonicWall NS series box. 10. Provide name and IP address of the new object. 11. Click OK. -12. In the Add Syslog Server dialog, find the IP address you specified on the step 10 in the Name or - IP Address list. +12. In the Add Syslog Server dialog, in the Name or IP Address list, find the IP address you + specified in step 10. 13. Click OK. 14. Click Save. @@ -105,16 +104,16 @@ Review a full list of object types Netwrix Auditor can collect on SonicWall netw | Object type | Actions | Event ID | | ------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Logon | - Successful logon | - User login from an internal zone allowed - User login successful - XAUTH Succeeded with VPN - VPN zone remote user login allowed - WAN zone remote user login allowed - PPP: Authentication successful - Local Authentication Success - RADIUS/LDAP Authentication Success - Successful authentication received for Remotely Triggered - IKEv2 Authentication successful - SSL VPN zone remote user login allowed | -| - Failed logon | - User login denied - User login failed - XAUTH Failed with VPN - L2TP PPP Authentication Failed - check username / password - RADIUS/LDAP reports Authentication Failure - Local Authentication Failure - User login to Administration Portal denied - User login failure rate exceeded - User Name authentication Failure locally - ISAKMP_AUTH_FAILED - Guest service limit reached - Guest login denied - Incorrect authentication received for Remotely Triggered - Authentication Timeout during Remotely Triggered - Problem occurred during user group membership retrieval - An error has occurred while sending your - IPsec Authentication Failed | | +| - Failed logon | - User login denied - User login failed - XAUTH Failed with VPN - L2TP PPP Authentication Failed - check username / password - RADIUS/LDAP reports Authentication Failure - Local Authentication Failure - User log in to Administration Portal denied - User login failure rate exceeded - User Name authentication Failure locally - ISAKMP_AUTH_FAILED - Guest service limit reached - Guest login denied - Incorrect authentication received for Remotely Triggered - Authentication Timeout during Remotely Triggered - Problem occurred during user group membership retrieval - An error has occurred while sending your - IPsec Authentication Failed | | | - Logoff | - User logged out - logged out - Guest Session Timeout - Guest Account Timeout - Guest Idle Timeout - Guest traffic quota exceeded | | | Authentication | - Successful Logon | - Administrator login allowed - CLI administrator login allowed - VPN zone administrator login allowed - WAN zone administrator login allowed - Configuration mode administration session started - Read-only mode GUI administration session started - Non-config mode GUI administration session started - User login successful - Session Start: - EventMessage: Session Start Success | -| - Failed Logon | - Administrator login denied - CLI administrator login denied due to bad credentials - User login failed - The account has been disabled for - is not permitted for this Web App - Authentication for user - Authentication failed - maximum authentication attempts exceeded for - EventMessage: Session Start Failed | | +| - Failed Logon | - Administrator login denied - CLI administrator login denied due to bad credentials - User login failed - The account has been disabled for - isn't permitted for this Web App - Authentication for user - Authentication failed - maximum authentication attempts exceeded for - EventMessage: Session Start Failed | | | - Logoff | - Administrator logged out - CLI administrator logged out - Configuration mode administration session ended - GUI administration session ended - Logged out - Session End: - EventMessage: Session End - Command='Tunnel' | | | Configuration | - Add / Added (Failed attempt) | - m=1333 - Scheduled settings generated - A new default Self-Signed certificate was generated successfully - Scheduled Tech Support Report generated - Restarted Tech Support Report generated | | - Modified / Modify (Failed attempt) | - Mail attachment disabled - Watch and report possible SYN floods - Watch and proxy WAN connections when under attack - Always proxy WAN connections - SYN Flood blacklisting enabled by user - SYN Flood blacklisting disabled by user - Administrator name changed - VPN disabled by administrator - VPN enabled by administrator - WLAN disabled by administrator - WLAN enabled by administrator - WLAN disabled by schedule - WLAN enabled by schedule - is added into Group - is removed from Group - m=1334 - Update administrator/user lockout params - Settings imported - Critical Operating System Update failed - msg=\"WAF restarted - HTTP(S) Cache settings were updated - database has been updated - Web Server Fingerprint Protection enforced - About to reconfigure service: - Finished applying configuration changes - Started - Start failed - Stopped | | -| - Read / Read (Failed attempt) | - m=1203 - m=1204 - Problem loading the URL list - Registration Update Needed, Please restore your existing security service subscriptions - Failed to synchronize license information with Licensing Server - Current settings exported - Error sending - settings sent successfully - Automated scheduled settings successful - Scheduled settings downloaded - Tech Support Report - Tech Support Report sent successfully - Loaded WAF signature database successfully - Error sending - logs sent out successfully | | +| - Read / Read (Failed attempt) | - m=1203 - m=1204 - Problem loading the URL list - Registration Update Needed, restore your existing security service subscriptions - Failed to synchronize license information with Licensing Server - Current settings exported - Error sending - settings sent successfully - Automated scheduled settings successful - Scheduled settings downloaded - Tech Support Report - Tech Support Report sent successfully - Loaded WAF signature database successfully - Error sending - logs sent out successfully | | | | - Remove / Removed (Failed attempt) | - Scheduled settings deleted - Oldest scheduled Tech Support Report deleted - has been deleted - Event Logs cleared - Audit Logs cleared - Access Logs cleared - Deleting log files - Deleting core files - Deleting snapshots older | -| Device state | - Modified / Modify (Failed attempt) | - Registration Update Needed, Please restore your existing security service subscriptions - Intrusion Prevention (IDP) subscription has expired - Failed to synchronize license information with Licensing Server | +| Device state | - Modified / Modify (Failed attempt) | - Registration Update Needed, restore your existing security service subscriptions - Intrusion Prevention (IDP) subscription has expired - Failed to synchronize license information with Licensing Server | | Folder | - Add / Added (Failed attempt) | - Request='GET /cgi-bin/sonicfiles?RacNumber=9&Arg1= | | - Read / Read (Failed attempt) | - Request='GET /cgi-bin/sonicfiles?RacNumber=16&Arg1= | | | - Remove / Removed (Failed attempt) | - Request='GET /cgi-bin/sonicfiles?RacNumber=13&Arg1= | | diff --git a/docs/auditor/10.9/configuration/networkdevices/ciscoasa.md b/docs/auditor/10.9/configuration/networkdevices/ciscoasa.md index f74d422ca4..2b8e9a3279 100644 --- a/docs/auditor/10.9/configuration/networkdevices/ciscoasa.md +++ b/docs/auditor/10.9/configuration/networkdevices/ciscoasa.md @@ -9,26 +9,25 @@ sidebar_position: 20 Netwrix Auditor relies on native logs for collecting audit data. Therefore, successful change and access auditing requires a certain configuration of native audit settings in the audited environment and on the Auditor console computer. Configuring your IT infrastructure may also include enabling -certain built-in Windows services, etc. Proper audit configuration is required to ensure audit data -integrity, otherwise your change reports may contain warnings, errors or incomplete audit data. +certain built-in Windows services, etc. Proper audit configuration ensures audit data integrity; +otherwise, your change reports may contain warnings, errors, or incomplete audit data. -**CAUTION:** Folder associated with Netwrix Auditor must be excluded from antivirus scanning. See -the +**CAUTION:** Exclude the folder associated with Netwrix Auditor from antivirus scanning. See the [Antivirus Exclusions for Netwrix Auditor](/docs/kb/auditor/system-administration/security-hardening/antivirus-exclusions-for-netwrix-auditor) knowledge base article for additional information. Configure native audit settings manually on the Cisco ASA device to ensure Netwrix Auditor collects comprehensive and reliable audit data: -- The global configuration mode is selected. -- The `logging enable `option is selected on the Cisco ASA device. -- The `logging host` parameter is set to the host address of the audited CiscoASA device. And UDP - port (for, example 514) is used for sending messages. +- Select the global configuration mode. +- Select the `logging enable` option on the Cisco ASA device. +- Set the `logging host` parameter to the host address of the audited Cisco ASA device, and use a + UDP port (for example, 514) to send messages. - **NOTE:** Do not select the EMBLEM format logging for the syslog server option. + **NOTE:** Don't select the EMBLEM format logging for the syslog server option. -- The `logging timestamp` option enabled. -- The `logging trap` option is selected from 1 to 6 inclusive. +- Enable the `logging timestamp` option. +- Select the `logging trap` option from 1 to 6 inclusive. To configure your Cisco ASA devices, do the following: @@ -45,12 +44,12 @@ To configure your Cisco ASA devices, do the following: hostname(config)# logging enable 4. Set the IP address of the computer that hosts Netwrix Auditor Server as the `logging host` - parameter. And make sure that the UDP port is used for sending syslog messages (e.g., 514 UDP + parameter, and ensure that the device uses a UDP port to send syslog messages (e.g., 514 UDP port). For example: hostname(config)# logging host `` - Do not select the EMBLEM format logging for the syslog server option. + Don't select the EMBLEM format logging for the syslog server option. 5. Enable the `logging timestamp` option. For example: diff --git a/docs/auditor/10.9/configuration/networkdevices/ciscoios.md b/docs/auditor/10.9/configuration/networkdevices/ciscoios.md index b9aef17b14..eb6cefe6fb 100644 --- a/docs/auditor/10.9/configuration/networkdevices/ciscoios.md +++ b/docs/auditor/10.9/configuration/networkdevices/ciscoios.md @@ -9,22 +9,21 @@ sidebar_position: 30 Netwrix Auditor relies on native logs for collecting audit data. Therefore, successful change and access auditing requires a certain configuration of native audit settings in the audited environment and on the Auditor console computer. Configuring your IT infrastructure may also include enabling -certain built-in Windows services, etc. Proper audit configuration is required to ensure audit data -integrity, otherwise your change reports may contain warnings, errors or incomplete audit data. +certain built-in Windows services, etc. Proper audit configuration ensures audit data integrity; +otherwise, your change reports may contain warnings, errors, or incomplete audit data. -**CAUTION:** Folder associated with Netwrix Auditor must be excluded from antivirus scanning. See -the +**CAUTION:** Exclude the folder associated with Netwrix Auditor from antivirus scanning. See the [Antivirus Exclusions for Netwrix Auditor](/docs/kb/auditor/system-administration/security-hardening/antivirus-exclusions-for-netwrix-auditor) knowledge base article for additional information. Configure native audit settings manually on the Cisco IOS device to ensure Netwrix Auditor collects comprehensive and reliable audit data: -- The global configuration mode is selected. -- The `logging timestamp` option enabled. -- The `logging trap` option is selected from 1 to 6 inclusive. -- The `logging host` parameter is set to the host address where the service is going to be - installed. And UDP port (for, example 514) is used for sending messages. +- Select the global configuration mode. +- Enable the `logging timestamp` option. +- Select the `logging trap` option from 1 to 6 inclusive. +- Set the `logging host` parameter to the host address where you plan to install the service, and + use a UDP port (for example, 514) to send messages. To configure your Cisco IOS devices, do the following: @@ -42,8 +41,8 @@ To configure your Cisco IOS devices, do the following: Router# logging trap 5 -5. Set the IP address of the Netwrix Auditor Server as the logging host parameter. And make sure - that the UDP port is used for sending syslog messages (e.g., 514 UDP port). For example: +5. Set the IP address of the Netwrix Auditor Server as the logging host parameter, and ensure that + the device uses a UDP port to send syslog messages (e.g., 514 UDP port). For example: Router# logging 192.168.1.5 diff --git a/docs/auditor/10.9/configuration/networkdevices/fortinetfortigate.md b/docs/auditor/10.9/configuration/networkdevices/fortinetfortigate.md index e71df2c3c5..08f616ae52 100644 --- a/docs/auditor/10.9/configuration/networkdevices/fortinetfortigate.md +++ b/docs/auditor/10.9/configuration/networkdevices/fortinetfortigate.md @@ -9,11 +9,10 @@ sidebar_position: 60 Netwrix Auditor relies on native logs for collecting audit data. Therefore, successful change and access auditing requires a certain configuration of native audit settings in the audited environment and on the Auditor console computer. Configuring your IT infrastructure may also include enabling -certain built-in Windows services, etc. Proper audit configuration is required to ensure audit data -integrity, otherwise your change reports may contain warnings, errors or incomplete audit data. +certain built-in Windows services, etc. Proper audit configuration ensures audit data integrity; +otherwise, your change reports may contain warnings, errors, or incomplete audit data. -**CAUTION:** Folder associated with Netwrix Auditor must be excluded from antivirus scanning. See -the +**CAUTION:** Exclude the folder associated with Netwrix Auditor from antivirus scanning. See the [Antivirus Exclusions for Netwrix Auditor](/docs/kb/auditor/system-administration/security-hardening/antivirus-exclusions-for-netwrix-auditor) knowledge base article for additional information. @@ -21,8 +20,8 @@ Configure native audit settings manually on the Fortinet FortiGate device via Co Interface (CLI) to ensure Netwrix Auditor collects comprehensive and reliable audit data. To configure your Fortinet FortiGate devices, enable logging to multiple Syslog servers and -configure FortiOS to send log messages to remote syslog servers in CEF format. Do one of the -following: +configure FortiOS to send log messages to remote syslog servers in Common Event Format (CEF). Do +one of the following: - To configure Fortinet FortiGate devices via Command Line Interface - To configure Fortinet FortiGate devices through the Fortigate Management Console diff --git a/docs/auditor/10.9/configuration/networkdevices/juniper.md b/docs/auditor/10.9/configuration/networkdevices/juniper.md index 5808dc5fff..997f99d316 100644 --- a/docs/auditor/10.9/configuration/networkdevices/juniper.md +++ b/docs/auditor/10.9/configuration/networkdevices/juniper.md @@ -9,11 +9,10 @@ sidebar_position: 80 Netwrix Auditor relies on native logs for collecting audit data. Therefore, successful change and access auditing requires a certain configuration of native audit settings in the audited environment and on the Auditor console computer. Configuring your IT infrastructure may also include enabling -certain built-in Windows services, etc. Proper audit configuration is required to ensure audit data -integrity, otherwise your change reports may contain warnings, errors or incomplete audit data. +certain built-in Windows services, etc. Proper audit configuration ensures audit data integrity; +otherwise, your change reports may contain warnings, errors, or incomplete audit data. -**CAUTION:** Folder associated with Netwrix Auditor must be excluded from antivirus scanning. See -the +**CAUTION:** Exclude the folder associated with Netwrix Auditor from antivirus scanning. See the [Antivirus Exclusions for Netwrix Auditor](/docs/kb/auditor/system-administration/security-hardening/antivirus-exclusions-for-netwrix-auditor) knowledge base article for additional information. @@ -29,14 +28,13 @@ To configure you Juniper devices, do the following: # set system syslog host `` any info - where `` is the IP address of the computer where Netwrix Auditor Server is - installed. + where `` is the IP address of the computer that hosts Netwrix Auditor Server. # set system syslog host `` port `` where - `` is the IP address of the computer where Netwrix Auditor Server is installed + `` is the IP address of the computer that hosts Netwrix Auditor Server AND diff --git a/docs/auditor/10.9/configuration/networkdevices/paloalto.md b/docs/auditor/10.9/configuration/networkdevices/paloalto.md index 9350081717..38969cf4fa 100644 --- a/docs/auditor/10.9/configuration/networkdevices/paloalto.md +++ b/docs/auditor/10.9/configuration/networkdevices/paloalto.md @@ -9,11 +9,10 @@ sidebar_position: 90 Netwrix Auditor relies on native logs for collecting audit data. Therefore, successful change and access auditing requires a certain configuration of native audit settings in the audited environment and on the Auditor console computer. Configuring your IT infrastructure may also include enabling -certain built-in Windows services, etc. Proper audit configuration is required to ensure audit data -integrity, otherwise your change reports may contain warnings, errors or incomplete audit data. +certain built-in Windows services, etc. Proper audit configuration ensures audit data integrity; +otherwise, your change reports may contain warnings, errors, or incomplete audit data. -**CAUTION:** Folder associated with Netwrix Auditor must be excluded from antivirus scanning. See -the +**CAUTION:** Exclude the folder associated with Netwrix Auditor from antivirus scanning. See the [Antivirus Exclusions for Netwrix Auditor](/docs/kb/auditor/system-administration/security-hardening/antivirus-exclusions-for-netwrix-auditor) knowledge base article for additional information. @@ -24,7 +23,7 @@ syslog forwarding for the target PaloAlto device. To configure your PaloAlto devices, create a Syslog server profile and assign it to the log settings for each log type. -Follow the steps to configure a Syslog server profile. +## Configure a Syslog server profile **Step 1 –** Connect to your PaloAlto device: launch an Internet browser and enter the IP address of the firewall in the URL field (https://``). @@ -44,19 +43,20 @@ the firewall in the URL field (https://``). | Format | Select IETF. | | Facility | Netwrix recommends using default values. | -Follow the steps to configure syslog forwarding. +## Configure syslog forwarding **Step 1 –** In the Web Interface, navigate to **Device** > **Log Settings**. **Step 2 –** For System, Config, and User ID logs, click Add and enter unique name of your syslog server. -**Step 3 –** On the syslog panel, click Add and select the syslog profile you created above. +**Step 3 –** On the syslog panel, click Add and select the syslog profile you created in +[Configure a Syslog server profile](#configure-a-syslog-server-profile). **Step 4 –** Click **Commit** and review the logs on the syslog server. -**NOTE:** After configuring the monitoring plan, Netwrix Auditor will listen to the logs forwarded -by the Palo Alto device. +**NOTE:** After you configure the monitoring plan, Netwrix Auditor listens to the logs forwarded by +the Palo Alto device. ## PaloAlto Devices diff --git a/docs/auditor/10.9/configuration/networkdevices/sonicwall.md b/docs/auditor/10.9/configuration/networkdevices/sonicwall.md index 4a90d8a2e9..176afe7b6b 100644 --- a/docs/auditor/10.9/configuration/networkdevices/sonicwall.md +++ b/docs/auditor/10.9/configuration/networkdevices/sonicwall.md @@ -9,11 +9,10 @@ sidebar_position: 110 Netwrix Auditor relies on native logs for collecting audit data. Therefore, successful change and access auditing requires a certain configuration of native audit settings in the audited environment and on the Auditor console computer. Configuring your IT infrastructure may also include enabling -certain built-in Windows services, etc. Proper audit configuration is required to ensure audit data -integrity, otherwise your change reports may contain warnings, errors or incomplete audit data. +certain built-in Windows services, etc. Proper audit configuration ensures audit data integrity; +otherwise, your change reports may contain warnings, errors, or incomplete audit data. -**CAUTION:** Folder associated with Netwrix Auditor must be excluded from antivirus scanning. See -the +**CAUTION:** Exclude the folder associated with Netwrix Auditor from antivirus scanning. See the [Antivirus Exclusions for Netwrix Auditor](/docs/kb/auditor/system-administration/security-hardening/antivirus-exclusions-for-netwrix-auditor) knowledge base article for additional information. @@ -93,8 +92,8 @@ To configure SonicWall NS series box. 10. Provide name and IP address of the new object. 11. Click OK. -12. In the Add Syslog Server dialog, find the IP address you specified on the step 10 in the Name or - IP Address list. +12. In the Add Syslog Server dialog, in the Name or IP Address list, find the IP address you + specified in step 10. 13. Click OK. 14. Click Save. @@ -105,16 +104,16 @@ Review a full list of object types Netwrix Auditor can collect on SonicWall netw | Object type | Actions | Event ID | | ------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Logon | - Successful logon | - User login from an internal zone allowed - User login successful - XAUTH Succeeded with VPN - VPN zone remote user login allowed - WAN zone remote user login allowed - PPP: Authentication successful - Local Authentication Success - RADIUS/LDAP Authentication Success - Successful authentication received for Remotely Triggered - IKEv2 Authentication successful - SSL VPN zone remote user login allowed | -| - Failed logon | - User login denied - User login failed - XAUTH Failed with VPN - L2TP PPP Authentication Failed - check username / password - RADIUS/LDAP reports Authentication Failure - Local Authentication Failure - User login to Administration Portal denied - User login failure rate exceeded - User Name authentication Failure locally - ISAKMP_AUTH_FAILED - Guest service limit reached - Guest login denied - Incorrect authentication received for Remotely Triggered - Authentication Timeout during Remotely Triggered - Problem occurred during user group membership retrieval - An error has occurred while sending your - IPsec Authentication Failed | | +| - Failed logon | - User login denied - User login failed - XAUTH Failed with VPN - L2TP PPP Authentication Failed - check username / password - RADIUS/LDAP reports Authentication Failure - Local Authentication Failure - User log in to Administration Portal denied - User login failure rate exceeded - User Name authentication Failure locally - ISAKMP_AUTH_FAILED - Guest service limit reached - Guest login denied - Incorrect authentication received for Remotely Triggered - Authentication Timeout during Remotely Triggered - Problem occurred during user group membership retrieval - An error has occurred while sending your - IPsec Authentication Failed | | | - Logoff | - User logged out - logged out - Guest Session Timeout - Guest Account Timeout - Guest Idle Timeout - Guest traffic quota exceeded | | | Authentication | - Successful Logon | - Administrator login allowed - CLI administrator login allowed - VPN zone administrator login allowed - WAN zone administrator login allowed - Configuration mode administration session started - Read-only mode GUI administration session started - Non-config mode GUI administration session started - User login successful - Session Start: - EventMessage: Session Start Success | -| - Failed Logon | - Administrator login denied - CLI administrator login denied due to bad credentials - User login failed - The account has been disabled for - is not permitted for this Web App - Authentication for user - Authentication failed - maximum authentication attempts exceeded for - EventMessage: Session Start Failed | | +| - Failed Logon | - Administrator login denied - CLI administrator login denied due to bad credentials - User login failed - The account has been disabled for - isn't permitted for this Web App - Authentication for user - Authentication failed - maximum authentication attempts exceeded for - EventMessage: Session Start Failed | | | - Logoff | - Administrator logged out - CLI administrator logged out - Configuration mode administration session ended - GUI administration session ended - Logged out - Session End: - EventMessage: Session End - Command='Tunnel' | | | Configuration | - Add / Added (Failed attempt) | - m=1333 - Scheduled settings generated - A new default Self-Signed certificate was generated successfully - Scheduled Tech Support Report generated - Restarted Tech Support Report generated | | - Modified / Modify (Failed attempt) | - Mail attachment disabled - Watch and report possible SYN floods - Watch and proxy WAN connections when under attack - Always proxy WAN connections - SYN Flood blacklisting enabled by user - SYN Flood blacklisting disabled by user - Administrator name changed - VPN disabled by administrator - VPN enabled by administrator - WLAN disabled by administrator - WLAN enabled by administrator - WLAN disabled by schedule - WLAN enabled by schedule - is added into Group - is removed from Group - m=1334 - Update administrator/user lockout params - Settings imported - Critical Operating System Update failed - msg=\"WAF restarted - HTTP(S) Cache settings were updated - database has been updated - Web Server Fingerprint Protection enforced - About to reconfigure service: - Finished applying configuration changes - Started - Start failed - Stopped | | -| - Read / Read (Failed attempt) | - m=1203 - m=1204 - Problem loading the URL list - Registration Update Needed, Please restore your existing security service subscriptions - Failed to synchronize license information with Licensing Server - Current settings exported - Error sending - settings sent successfully - Automated scheduled settings successful - Scheduled settings downloaded - Tech Support Report - Tech Support Report sent successfully - Loaded WAF signature database successfully - Error sending - logs sent out successfully | | +| - Read / Read (Failed attempt) | - m=1203 - m=1204 - Problem loading the URL list - Registration Update Needed, restore your existing security service subscriptions - Failed to synchronize license information with Licensing Server - Current settings exported - Error sending - settings sent successfully - Automated scheduled settings successful - Scheduled settings downloaded - Tech Support Report - Tech Support Report sent successfully - Loaded WAF signature database successfully - Error sending - logs sent out successfully | | | | - Remove / Removed (Failed attempt) | - Scheduled settings deleted - Oldest scheduled Tech Support Report deleted - has been deleted - Event Logs cleared - Audit Logs cleared - Access Logs cleared - Deleting log files - Deleting core files - Deleting snapshots older | -| Device state | - Modified / Modify (Failed attempt) | - Registration Update Needed, Please restore your existing security service subscriptions - Intrusion Prevention (IDP) subscription has expired - Failed to synchronize license information with Licensing Server | +| Device state | - Modified / Modify (Failed attempt) | - Registration Update Needed, restore your existing security service subscriptions - Intrusion Prevention (IDP) subscription has expired - Failed to synchronize license information with Licensing Server | | Folder | - Add / Added (Failed attempt) | - Request='GET /cgi-bin/sonicfiles?RacNumber=9&Arg1= | | - Read / Read (Failed attempt) | - Request='GET /cgi-bin/sonicfiles?RacNumber=16&Arg1= | | | - Remove / Removed (Failed attempt) | - Request='GET /cgi-bin/sonicfiles?RacNumber=13&Arg1= | | From 7b36b06928c089401001a915cebe304f64e7d49c Mon Sep 17 00:00:00 2001 From: TheCat Date: Tue, 18 Aug 2026 20:32:28 +0100 Subject: [PATCH 3/9] Tighten intro paragraph in network device config docs Replace the generic Windows-oriented boilerplate intro ('native logs', 'on the Auditor console computer', 'enabling certain built-in Windows services') with wording accurate for network devices: they emit native syslog events, and there's no Auditor-console-side or Windows-service configuration involved. Co-Authored-By: Claude Sonnet 5 --- .../10.7/configuration/networkdevices/ciscoasa.md | 9 ++++----- .../10.7/configuration/networkdevices/ciscoios.md | 9 ++++----- .../configuration/networkdevices/fortinetfortigate.md | 9 ++++----- .../auditor/10.7/configuration/networkdevices/juniper.md | 9 ++++----- .../10.7/configuration/networkdevices/paloalto.md | 9 ++++----- .../10.7/configuration/networkdevices/sonicwall.md | 9 ++++----- .../10.8/configuration/networkdevices/ciscoasa.md | 9 ++++----- .../10.8/configuration/networkdevices/ciscoios.md | 9 ++++----- .../configuration/networkdevices/fortinetfortigate.md | 9 ++++----- .../auditor/10.8/configuration/networkdevices/juniper.md | 9 ++++----- .../10.8/configuration/networkdevices/paloalto.md | 9 ++++----- .../10.8/configuration/networkdevices/sonicwall.md | 9 ++++----- .../10.9/configuration/networkdevices/ciscoasa.md | 9 ++++----- .../10.9/configuration/networkdevices/ciscoios.md | 9 ++++----- .../configuration/networkdevices/fortinetfortigate.md | 9 ++++----- .../auditor/10.9/configuration/networkdevices/juniper.md | 9 ++++----- .../10.9/configuration/networkdevices/paloalto.md | 9 ++++----- .../10.9/configuration/networkdevices/sonicwall.md | 9 ++++----- 18 files changed, 72 insertions(+), 90 deletions(-) diff --git a/docs/auditor/10.7/configuration/networkdevices/ciscoasa.md b/docs/auditor/10.7/configuration/networkdevices/ciscoasa.md index 2b8e9a3279..af973098c5 100644 --- a/docs/auditor/10.7/configuration/networkdevices/ciscoasa.md +++ b/docs/auditor/10.7/configuration/networkdevices/ciscoasa.md @@ -6,11 +6,10 @@ sidebar_position: 20 # Configure Cisco ASA Devices -Netwrix Auditor relies on native logs for collecting audit data. Therefore, successful change and -access auditing requires a certain configuration of native audit settings in the audited environment -and on the Auditor console computer. Configuring your IT infrastructure may also include enabling -certain built-in Windows services, etc. Proper audit configuration ensures audit data integrity; -otherwise, your change reports may contain warnings, errors, or incomplete audit data. +Netwrix Auditor relies on native syslog events for collecting audit data. Therefore, successful +change and access auditing requires a certain configuration of native audit settings in the audited +environment. Proper audit configuration ensures audit data integrity; otherwise, your change reports +may contain warnings, errors, or incomplete audit data. **CAUTION:** Exclude the folder associated with Netwrix Auditor from antivirus scanning. See the [Antivirus Exclusions for Netwrix Auditor](/docs/kb/auditor/system-administration/security-hardening/antivirus-exclusions-for-netwrix-auditor) diff --git a/docs/auditor/10.7/configuration/networkdevices/ciscoios.md b/docs/auditor/10.7/configuration/networkdevices/ciscoios.md index eb6cefe6fb..1c2e5e5904 100644 --- a/docs/auditor/10.7/configuration/networkdevices/ciscoios.md +++ b/docs/auditor/10.7/configuration/networkdevices/ciscoios.md @@ -6,11 +6,10 @@ sidebar_position: 30 # Configure Cisco IOS Devices -Netwrix Auditor relies on native logs for collecting audit data. Therefore, successful change and -access auditing requires a certain configuration of native audit settings in the audited environment -and on the Auditor console computer. Configuring your IT infrastructure may also include enabling -certain built-in Windows services, etc. Proper audit configuration ensures audit data integrity; -otherwise, your change reports may contain warnings, errors, or incomplete audit data. +Netwrix Auditor relies on native syslog events for collecting audit data. Therefore, successful +change and access auditing requires a certain configuration of native audit settings in the audited +environment. Proper audit configuration ensures audit data integrity; otherwise, your change reports +may contain warnings, errors, or incomplete audit data. **CAUTION:** Exclude the folder associated with Netwrix Auditor from antivirus scanning. See the [Antivirus Exclusions for Netwrix Auditor](/docs/kb/auditor/system-administration/security-hardening/antivirus-exclusions-for-netwrix-auditor) diff --git a/docs/auditor/10.7/configuration/networkdevices/fortinetfortigate.md b/docs/auditor/10.7/configuration/networkdevices/fortinetfortigate.md index 08f616ae52..088cbf25e1 100644 --- a/docs/auditor/10.7/configuration/networkdevices/fortinetfortigate.md +++ b/docs/auditor/10.7/configuration/networkdevices/fortinetfortigate.md @@ -6,11 +6,10 @@ sidebar_position: 60 # Configure Fortinet FortiGate Devices -Netwrix Auditor relies on native logs for collecting audit data. Therefore, successful change and -access auditing requires a certain configuration of native audit settings in the audited environment -and on the Auditor console computer. Configuring your IT infrastructure may also include enabling -certain built-in Windows services, etc. Proper audit configuration ensures audit data integrity; -otherwise, your change reports may contain warnings, errors, or incomplete audit data. +Netwrix Auditor relies on native syslog events for collecting audit data. Therefore, successful +change and access auditing requires a certain configuration of native audit settings in the audited +environment. Proper audit configuration ensures audit data integrity; otherwise, your change reports +may contain warnings, errors, or incomplete audit data. **CAUTION:** Exclude the folder associated with Netwrix Auditor from antivirus scanning. See the [Antivirus Exclusions for Netwrix Auditor](/docs/kb/auditor/system-administration/security-hardening/antivirus-exclusions-for-netwrix-auditor) diff --git a/docs/auditor/10.7/configuration/networkdevices/juniper.md b/docs/auditor/10.7/configuration/networkdevices/juniper.md index 3861e900a7..eeaa418521 100644 --- a/docs/auditor/10.7/configuration/networkdevices/juniper.md +++ b/docs/auditor/10.7/configuration/networkdevices/juniper.md @@ -6,11 +6,10 @@ sidebar_position: 80 # Configure Juniper Devices -Netwrix Auditor relies on native logs for collecting audit data. Therefore, successful change and -access auditing requires a certain configuration of native audit settings in the audited environment -and on the Auditor console computer. Configuring your IT infrastructure may also include enabling -certain built-in Windows services, etc. Proper audit configuration ensures audit data integrity; -otherwise, your change reports may contain warnings, errors, or incomplete audit data. +Netwrix Auditor relies on native syslog events for collecting audit data. Therefore, successful +change and access auditing requires a certain configuration of native audit settings in the audited +environment. Proper audit configuration ensures audit data integrity; otherwise, your change reports +may contain warnings, errors, or incomplete audit data. **CAUTION:** Exclude the folder associated with Netwrix Auditor from antivirus scanning. See the [Antivirus Exclusions for Netwrix Auditor](/docs/kb/auditor/system-administration/security-hardening/antivirus-exclusions-for-netwrix-auditor) diff --git a/docs/auditor/10.7/configuration/networkdevices/paloalto.md b/docs/auditor/10.7/configuration/networkdevices/paloalto.md index 38969cf4fa..c2c8844919 100644 --- a/docs/auditor/10.7/configuration/networkdevices/paloalto.md +++ b/docs/auditor/10.7/configuration/networkdevices/paloalto.md @@ -6,11 +6,10 @@ sidebar_position: 90 # Configure PaloAlto Devices -Netwrix Auditor relies on native logs for collecting audit data. Therefore, successful change and -access auditing requires a certain configuration of native audit settings in the audited environment -and on the Auditor console computer. Configuring your IT infrastructure may also include enabling -certain built-in Windows services, etc. Proper audit configuration ensures audit data integrity; -otherwise, your change reports may contain warnings, errors, or incomplete audit data. +Netwrix Auditor relies on native syslog events for collecting audit data. Therefore, successful +change and access auditing requires a certain configuration of native audit settings in the audited +environment. Proper audit configuration ensures audit data integrity; otherwise, your change reports +may contain warnings, errors, or incomplete audit data. **CAUTION:** Exclude the folder associated with Netwrix Auditor from antivirus scanning. See the [Antivirus Exclusions for Netwrix Auditor](/docs/kb/auditor/system-administration/security-hardening/antivirus-exclusions-for-netwrix-auditor) diff --git a/docs/auditor/10.7/configuration/networkdevices/sonicwall.md b/docs/auditor/10.7/configuration/networkdevices/sonicwall.md index 176afe7b6b..cde4b4514a 100644 --- a/docs/auditor/10.7/configuration/networkdevices/sonicwall.md +++ b/docs/auditor/10.7/configuration/networkdevices/sonicwall.md @@ -6,11 +6,10 @@ sidebar_position: 110 # Configure SonicWall Devices -Netwrix Auditor relies on native logs for collecting audit data. Therefore, successful change and -access auditing requires a certain configuration of native audit settings in the audited environment -and on the Auditor console computer. Configuring your IT infrastructure may also include enabling -certain built-in Windows services, etc. Proper audit configuration ensures audit data integrity; -otherwise, your change reports may contain warnings, errors, or incomplete audit data. +Netwrix Auditor relies on native syslog events for collecting audit data. Therefore, successful +change and access auditing requires a certain configuration of native audit settings in the audited +environment. Proper audit configuration ensures audit data integrity; otherwise, your change reports +may contain warnings, errors, or incomplete audit data. **CAUTION:** Exclude the folder associated with Netwrix Auditor from antivirus scanning. See the [Antivirus Exclusions for Netwrix Auditor](/docs/kb/auditor/system-administration/security-hardening/antivirus-exclusions-for-netwrix-auditor) diff --git a/docs/auditor/10.8/configuration/networkdevices/ciscoasa.md b/docs/auditor/10.8/configuration/networkdevices/ciscoasa.md index 2b8e9a3279..af973098c5 100644 --- a/docs/auditor/10.8/configuration/networkdevices/ciscoasa.md +++ b/docs/auditor/10.8/configuration/networkdevices/ciscoasa.md @@ -6,11 +6,10 @@ sidebar_position: 20 # Configure Cisco ASA Devices -Netwrix Auditor relies on native logs for collecting audit data. Therefore, successful change and -access auditing requires a certain configuration of native audit settings in the audited environment -and on the Auditor console computer. Configuring your IT infrastructure may also include enabling -certain built-in Windows services, etc. Proper audit configuration ensures audit data integrity; -otherwise, your change reports may contain warnings, errors, or incomplete audit data. +Netwrix Auditor relies on native syslog events for collecting audit data. Therefore, successful +change and access auditing requires a certain configuration of native audit settings in the audited +environment. Proper audit configuration ensures audit data integrity; otherwise, your change reports +may contain warnings, errors, or incomplete audit data. **CAUTION:** Exclude the folder associated with Netwrix Auditor from antivirus scanning. See the [Antivirus Exclusions for Netwrix Auditor](/docs/kb/auditor/system-administration/security-hardening/antivirus-exclusions-for-netwrix-auditor) diff --git a/docs/auditor/10.8/configuration/networkdevices/ciscoios.md b/docs/auditor/10.8/configuration/networkdevices/ciscoios.md index eb6cefe6fb..1c2e5e5904 100644 --- a/docs/auditor/10.8/configuration/networkdevices/ciscoios.md +++ b/docs/auditor/10.8/configuration/networkdevices/ciscoios.md @@ -6,11 +6,10 @@ sidebar_position: 30 # Configure Cisco IOS Devices -Netwrix Auditor relies on native logs for collecting audit data. Therefore, successful change and -access auditing requires a certain configuration of native audit settings in the audited environment -and on the Auditor console computer. Configuring your IT infrastructure may also include enabling -certain built-in Windows services, etc. Proper audit configuration ensures audit data integrity; -otherwise, your change reports may contain warnings, errors, or incomplete audit data. +Netwrix Auditor relies on native syslog events for collecting audit data. Therefore, successful +change and access auditing requires a certain configuration of native audit settings in the audited +environment. Proper audit configuration ensures audit data integrity; otherwise, your change reports +may contain warnings, errors, or incomplete audit data. **CAUTION:** Exclude the folder associated with Netwrix Auditor from antivirus scanning. See the [Antivirus Exclusions for Netwrix Auditor](/docs/kb/auditor/system-administration/security-hardening/antivirus-exclusions-for-netwrix-auditor) diff --git a/docs/auditor/10.8/configuration/networkdevices/fortinetfortigate.md b/docs/auditor/10.8/configuration/networkdevices/fortinetfortigate.md index 08f616ae52..088cbf25e1 100644 --- a/docs/auditor/10.8/configuration/networkdevices/fortinetfortigate.md +++ b/docs/auditor/10.8/configuration/networkdevices/fortinetfortigate.md @@ -6,11 +6,10 @@ sidebar_position: 60 # Configure Fortinet FortiGate Devices -Netwrix Auditor relies on native logs for collecting audit data. Therefore, successful change and -access auditing requires a certain configuration of native audit settings in the audited environment -and on the Auditor console computer. Configuring your IT infrastructure may also include enabling -certain built-in Windows services, etc. Proper audit configuration ensures audit data integrity; -otherwise, your change reports may contain warnings, errors, or incomplete audit data. +Netwrix Auditor relies on native syslog events for collecting audit data. Therefore, successful +change and access auditing requires a certain configuration of native audit settings in the audited +environment. Proper audit configuration ensures audit data integrity; otherwise, your change reports +may contain warnings, errors, or incomplete audit data. **CAUTION:** Exclude the folder associated with Netwrix Auditor from antivirus scanning. See the [Antivirus Exclusions for Netwrix Auditor](/docs/kb/auditor/system-administration/security-hardening/antivirus-exclusions-for-netwrix-auditor) diff --git a/docs/auditor/10.8/configuration/networkdevices/juniper.md b/docs/auditor/10.8/configuration/networkdevices/juniper.md index b56f70dc1b..1f0da112da 100644 --- a/docs/auditor/10.8/configuration/networkdevices/juniper.md +++ b/docs/auditor/10.8/configuration/networkdevices/juniper.md @@ -6,11 +6,10 @@ sidebar_position: 80 # Configure Juniper Devices -Netwrix Auditor relies on native logs for collecting audit data. Therefore, successful change and -access auditing requires a certain configuration of native audit settings in the audited environment -and on the Auditor console computer. Configuring your IT infrastructure may also include enabling -certain built-in Windows services, etc. Proper audit configuration ensures audit data integrity; -otherwise, your change reports may contain warnings, errors, or incomplete audit data. +Netwrix Auditor relies on native syslog events for collecting audit data. Therefore, successful +change and access auditing requires a certain configuration of native audit settings in the audited +environment. Proper audit configuration ensures audit data integrity; otherwise, your change reports +may contain warnings, errors, or incomplete audit data. **CAUTION:** Exclude the folder associated with Netwrix Auditor from antivirus scanning. See the [Antivirus Exclusions for Netwrix Auditor](/docs/kb/auditor/system-administration/security-hardening/antivirus-exclusions-for-netwrix-auditor) diff --git a/docs/auditor/10.8/configuration/networkdevices/paloalto.md b/docs/auditor/10.8/configuration/networkdevices/paloalto.md index 38969cf4fa..c2c8844919 100644 --- a/docs/auditor/10.8/configuration/networkdevices/paloalto.md +++ b/docs/auditor/10.8/configuration/networkdevices/paloalto.md @@ -6,11 +6,10 @@ sidebar_position: 90 # Configure PaloAlto Devices -Netwrix Auditor relies on native logs for collecting audit data. Therefore, successful change and -access auditing requires a certain configuration of native audit settings in the audited environment -and on the Auditor console computer. Configuring your IT infrastructure may also include enabling -certain built-in Windows services, etc. Proper audit configuration ensures audit data integrity; -otherwise, your change reports may contain warnings, errors, or incomplete audit data. +Netwrix Auditor relies on native syslog events for collecting audit data. Therefore, successful +change and access auditing requires a certain configuration of native audit settings in the audited +environment. Proper audit configuration ensures audit data integrity; otherwise, your change reports +may contain warnings, errors, or incomplete audit data. **CAUTION:** Exclude the folder associated with Netwrix Auditor from antivirus scanning. See the [Antivirus Exclusions for Netwrix Auditor](/docs/kb/auditor/system-administration/security-hardening/antivirus-exclusions-for-netwrix-auditor) diff --git a/docs/auditor/10.8/configuration/networkdevices/sonicwall.md b/docs/auditor/10.8/configuration/networkdevices/sonicwall.md index 176afe7b6b..cde4b4514a 100644 --- a/docs/auditor/10.8/configuration/networkdevices/sonicwall.md +++ b/docs/auditor/10.8/configuration/networkdevices/sonicwall.md @@ -6,11 +6,10 @@ sidebar_position: 110 # Configure SonicWall Devices -Netwrix Auditor relies on native logs for collecting audit data. Therefore, successful change and -access auditing requires a certain configuration of native audit settings in the audited environment -and on the Auditor console computer. Configuring your IT infrastructure may also include enabling -certain built-in Windows services, etc. Proper audit configuration ensures audit data integrity; -otherwise, your change reports may contain warnings, errors, or incomplete audit data. +Netwrix Auditor relies on native syslog events for collecting audit data. Therefore, successful +change and access auditing requires a certain configuration of native audit settings in the audited +environment. Proper audit configuration ensures audit data integrity; otherwise, your change reports +may contain warnings, errors, or incomplete audit data. **CAUTION:** Exclude the folder associated with Netwrix Auditor from antivirus scanning. See the [Antivirus Exclusions for Netwrix Auditor](/docs/kb/auditor/system-administration/security-hardening/antivirus-exclusions-for-netwrix-auditor) diff --git a/docs/auditor/10.9/configuration/networkdevices/ciscoasa.md b/docs/auditor/10.9/configuration/networkdevices/ciscoasa.md index 2b8e9a3279..af973098c5 100644 --- a/docs/auditor/10.9/configuration/networkdevices/ciscoasa.md +++ b/docs/auditor/10.9/configuration/networkdevices/ciscoasa.md @@ -6,11 +6,10 @@ sidebar_position: 20 # Configure Cisco ASA Devices -Netwrix Auditor relies on native logs for collecting audit data. Therefore, successful change and -access auditing requires a certain configuration of native audit settings in the audited environment -and on the Auditor console computer. Configuring your IT infrastructure may also include enabling -certain built-in Windows services, etc. Proper audit configuration ensures audit data integrity; -otherwise, your change reports may contain warnings, errors, or incomplete audit data. +Netwrix Auditor relies on native syslog events for collecting audit data. Therefore, successful +change and access auditing requires a certain configuration of native audit settings in the audited +environment. Proper audit configuration ensures audit data integrity; otherwise, your change reports +may contain warnings, errors, or incomplete audit data. **CAUTION:** Exclude the folder associated with Netwrix Auditor from antivirus scanning. See the [Antivirus Exclusions for Netwrix Auditor](/docs/kb/auditor/system-administration/security-hardening/antivirus-exclusions-for-netwrix-auditor) diff --git a/docs/auditor/10.9/configuration/networkdevices/ciscoios.md b/docs/auditor/10.9/configuration/networkdevices/ciscoios.md index eb6cefe6fb..1c2e5e5904 100644 --- a/docs/auditor/10.9/configuration/networkdevices/ciscoios.md +++ b/docs/auditor/10.9/configuration/networkdevices/ciscoios.md @@ -6,11 +6,10 @@ sidebar_position: 30 # Configure Cisco IOS Devices -Netwrix Auditor relies on native logs for collecting audit data. Therefore, successful change and -access auditing requires a certain configuration of native audit settings in the audited environment -and on the Auditor console computer. Configuring your IT infrastructure may also include enabling -certain built-in Windows services, etc. Proper audit configuration ensures audit data integrity; -otherwise, your change reports may contain warnings, errors, or incomplete audit data. +Netwrix Auditor relies on native syslog events for collecting audit data. Therefore, successful +change and access auditing requires a certain configuration of native audit settings in the audited +environment. Proper audit configuration ensures audit data integrity; otherwise, your change reports +may contain warnings, errors, or incomplete audit data. **CAUTION:** Exclude the folder associated with Netwrix Auditor from antivirus scanning. See the [Antivirus Exclusions for Netwrix Auditor](/docs/kb/auditor/system-administration/security-hardening/antivirus-exclusions-for-netwrix-auditor) diff --git a/docs/auditor/10.9/configuration/networkdevices/fortinetfortigate.md b/docs/auditor/10.9/configuration/networkdevices/fortinetfortigate.md index 08f616ae52..088cbf25e1 100644 --- a/docs/auditor/10.9/configuration/networkdevices/fortinetfortigate.md +++ b/docs/auditor/10.9/configuration/networkdevices/fortinetfortigate.md @@ -6,11 +6,10 @@ sidebar_position: 60 # Configure Fortinet FortiGate Devices -Netwrix Auditor relies on native logs for collecting audit data. Therefore, successful change and -access auditing requires a certain configuration of native audit settings in the audited environment -and on the Auditor console computer. Configuring your IT infrastructure may also include enabling -certain built-in Windows services, etc. Proper audit configuration ensures audit data integrity; -otherwise, your change reports may contain warnings, errors, or incomplete audit data. +Netwrix Auditor relies on native syslog events for collecting audit data. Therefore, successful +change and access auditing requires a certain configuration of native audit settings in the audited +environment. Proper audit configuration ensures audit data integrity; otherwise, your change reports +may contain warnings, errors, or incomplete audit data. **CAUTION:** Exclude the folder associated with Netwrix Auditor from antivirus scanning. See the [Antivirus Exclusions for Netwrix Auditor](/docs/kb/auditor/system-administration/security-hardening/antivirus-exclusions-for-netwrix-auditor) diff --git a/docs/auditor/10.9/configuration/networkdevices/juniper.md b/docs/auditor/10.9/configuration/networkdevices/juniper.md index 997f99d316..15c204ace0 100644 --- a/docs/auditor/10.9/configuration/networkdevices/juniper.md +++ b/docs/auditor/10.9/configuration/networkdevices/juniper.md @@ -6,11 +6,10 @@ sidebar_position: 80 # Configure Juniper Devices -Netwrix Auditor relies on native logs for collecting audit data. Therefore, successful change and -access auditing requires a certain configuration of native audit settings in the audited environment -and on the Auditor console computer. Configuring your IT infrastructure may also include enabling -certain built-in Windows services, etc. Proper audit configuration ensures audit data integrity; -otherwise, your change reports may contain warnings, errors, or incomplete audit data. +Netwrix Auditor relies on native syslog events for collecting audit data. Therefore, successful +change and access auditing requires a certain configuration of native audit settings in the audited +environment. Proper audit configuration ensures audit data integrity; otherwise, your change reports +may contain warnings, errors, or incomplete audit data. **CAUTION:** Exclude the folder associated with Netwrix Auditor from antivirus scanning. See the [Antivirus Exclusions for Netwrix Auditor](/docs/kb/auditor/system-administration/security-hardening/antivirus-exclusions-for-netwrix-auditor) diff --git a/docs/auditor/10.9/configuration/networkdevices/paloalto.md b/docs/auditor/10.9/configuration/networkdevices/paloalto.md index 38969cf4fa..c2c8844919 100644 --- a/docs/auditor/10.9/configuration/networkdevices/paloalto.md +++ b/docs/auditor/10.9/configuration/networkdevices/paloalto.md @@ -6,11 +6,10 @@ sidebar_position: 90 # Configure PaloAlto Devices -Netwrix Auditor relies on native logs for collecting audit data. Therefore, successful change and -access auditing requires a certain configuration of native audit settings in the audited environment -and on the Auditor console computer. Configuring your IT infrastructure may also include enabling -certain built-in Windows services, etc. Proper audit configuration ensures audit data integrity; -otherwise, your change reports may contain warnings, errors, or incomplete audit data. +Netwrix Auditor relies on native syslog events for collecting audit data. Therefore, successful +change and access auditing requires a certain configuration of native audit settings in the audited +environment. Proper audit configuration ensures audit data integrity; otherwise, your change reports +may contain warnings, errors, or incomplete audit data. **CAUTION:** Exclude the folder associated with Netwrix Auditor from antivirus scanning. See the [Antivirus Exclusions for Netwrix Auditor](/docs/kb/auditor/system-administration/security-hardening/antivirus-exclusions-for-netwrix-auditor) diff --git a/docs/auditor/10.9/configuration/networkdevices/sonicwall.md b/docs/auditor/10.9/configuration/networkdevices/sonicwall.md index 176afe7b6b..cde4b4514a 100644 --- a/docs/auditor/10.9/configuration/networkdevices/sonicwall.md +++ b/docs/auditor/10.9/configuration/networkdevices/sonicwall.md @@ -6,11 +6,10 @@ sidebar_position: 110 # Configure SonicWall Devices -Netwrix Auditor relies on native logs for collecting audit data. Therefore, successful change and -access auditing requires a certain configuration of native audit settings in the audited environment -and on the Auditor console computer. Configuring your IT infrastructure may also include enabling -certain built-in Windows services, etc. Proper audit configuration ensures audit data integrity; -otherwise, your change reports may contain warnings, errors, or incomplete audit data. +Netwrix Auditor relies on native syslog events for collecting audit data. Therefore, successful +change and access auditing requires a certain configuration of native audit settings in the audited +environment. Proper audit configuration ensures audit data integrity; otherwise, your change reports +may contain warnings, errors, or incomplete audit data. **CAUTION:** Exclude the folder associated with Netwrix Auditor from antivirus scanning. See the [Antivirus Exclusions for Netwrix Auditor](/docs/kb/auditor/system-administration/security-hardening/antivirus-exclusions-for-netwrix-auditor) From c54ddeeb9c2beeacfce8709a68cf596d510e6d7a Mon Sep 17 00:00:00 2001 From: "claude[bot]" <41898282+claude[bot]@users.noreply.github.com> Date: Tue, 18 Aug 2026 19:37:19 +0000 Subject: [PATCH 4/9] fix(vale): auto-fix style issues (Vale + Dale) --- docs/auditor/10.7/configuration/networkdevices/paloalto.md | 7 +++---- docs/auditor/10.8/configuration/networkdevices/paloalto.md | 7 +++---- docs/auditor/10.9/configuration/networkdevices/paloalto.md | 7 +++---- 3 files changed, 9 insertions(+), 12 deletions(-) diff --git a/docs/auditor/10.7/configuration/networkdevices/paloalto.md b/docs/auditor/10.7/configuration/networkdevices/paloalto.md index c2c8844919..dfd2e04e7d 100644 --- a/docs/auditor/10.7/configuration/networkdevices/paloalto.md +++ b/docs/auditor/10.7/configuration/networkdevices/paloalto.md @@ -16,8 +16,7 @@ may contain warnings, errors, or incomplete audit data. knowledge base article for additional information. Configure native audit settings manually on the PaloAlto device via Web Interface to ensure -Netwrix Auditor collects comprehensive and reliable audit data: create a Syslog Server profile and -syslog forwarding for the target PaloAlto device. +Netwrix Auditor collects comprehensive and reliable audit data. To configure your PaloAlto devices, create a Syslog server profile and assign it to the log settings for each log type. @@ -54,8 +53,8 @@ server. **Step 4 –** Click **Commit** and review the logs on the syslog server. -**NOTE:** After you configure the monitoring plan, Netwrix Auditor listens to the logs forwarded by -the Palo Alto device. +**NOTE:** After you configure the monitoring plan, Netwrix Auditor listens to the logs that the +Palo Alto device forwards. ## PaloAlto Devices diff --git a/docs/auditor/10.8/configuration/networkdevices/paloalto.md b/docs/auditor/10.8/configuration/networkdevices/paloalto.md index c2c8844919..dfd2e04e7d 100644 --- a/docs/auditor/10.8/configuration/networkdevices/paloalto.md +++ b/docs/auditor/10.8/configuration/networkdevices/paloalto.md @@ -16,8 +16,7 @@ may contain warnings, errors, or incomplete audit data. knowledge base article for additional information. Configure native audit settings manually on the PaloAlto device via Web Interface to ensure -Netwrix Auditor collects comprehensive and reliable audit data: create a Syslog Server profile and -syslog forwarding for the target PaloAlto device. +Netwrix Auditor collects comprehensive and reliable audit data. To configure your PaloAlto devices, create a Syslog server profile and assign it to the log settings for each log type. @@ -54,8 +53,8 @@ server. **Step 4 –** Click **Commit** and review the logs on the syslog server. -**NOTE:** After you configure the monitoring plan, Netwrix Auditor listens to the logs forwarded by -the Palo Alto device. +**NOTE:** After you configure the monitoring plan, Netwrix Auditor listens to the logs that the +Palo Alto device forwards. ## PaloAlto Devices diff --git a/docs/auditor/10.9/configuration/networkdevices/paloalto.md b/docs/auditor/10.9/configuration/networkdevices/paloalto.md index c2c8844919..dfd2e04e7d 100644 --- a/docs/auditor/10.9/configuration/networkdevices/paloalto.md +++ b/docs/auditor/10.9/configuration/networkdevices/paloalto.md @@ -16,8 +16,7 @@ may contain warnings, errors, or incomplete audit data. knowledge base article for additional information. Configure native audit settings manually on the PaloAlto device via Web Interface to ensure -Netwrix Auditor collects comprehensive and reliable audit data: create a Syslog Server profile and -syslog forwarding for the target PaloAlto device. +Netwrix Auditor collects comprehensive and reliable audit data. To configure your PaloAlto devices, create a Syslog server profile and assign it to the log settings for each log type. @@ -54,8 +53,8 @@ server. **Step 4 –** Click **Commit** and review the logs on the syslog server. -**NOTE:** After you configure the monitoring plan, Netwrix Auditor listens to the logs forwarded by -the Palo Alto device. +**NOTE:** After you configure the monitoring plan, Netwrix Auditor listens to the logs that the +Palo Alto device forwards. ## PaloAlto Devices From b8200f0051a5258f609a2902b3ddde70dcdb8efd Mon Sep 17 00:00:00 2001 From: TheCat Date: Tue, 18 Aug 2026 21:23:08 +0100 Subject: [PATCH 5/9] Address editorial review of network device docs - ciscoasa.md: explain that config is manual because Netwrix Auditor can't push configuration to network devices; reframe the settings list as an end state; resolve the duplicated EMBLEM-format NOTE in the procedure - ciscoios.md: same manual-config rationale and end-state reframing; name Netwrix Auditor Server explicitly in the logging host bullet - fortinetfortigate.md: drop the CLI-only claim in the intro that contradicted the CLI-vs-Management-Console choice presented below it - juniper.md: use 'Junos OS command line interface (CLI)'; rewrite the preamble so it no longer restates procedure step 1 - paloalto.md: add the missing article ('the web interface'); normalize 'syslog server profile' casing; use 'Palo Alto device' - sonicwall.md: revert 4 verbatim device event strings that the previous autofix pass altered (Please restore..., User login to Administration Portal denied, is not permitted for this Web App); fix the double 'Configure' intro sentence; restore table row padding for two rows Applied to Auditor 10.7, 10.8, and 10.9. Co-Authored-By: Claude Sonnet 5 --- .../configuration/networkdevices/ciscoasa.md | 16 +++++++--------- .../configuration/networkdevices/ciscoios.md | 16 ++++++++-------- .../networkdevices/fortinetfortigate.md | 4 ++-- .../10.7/configuration/networkdevices/juniper.md | 8 ++++---- .../configuration/networkdevices/paloalto.md | 10 +++++----- .../configuration/networkdevices/sonicwall.md | 11 +++++------ .../configuration/networkdevices/ciscoasa.md | 16 +++++++--------- .../configuration/networkdevices/ciscoios.md | 16 ++++++++-------- .../networkdevices/fortinetfortigate.md | 4 ++-- .../10.8/configuration/networkdevices/juniper.md | 8 ++++---- .../configuration/networkdevices/paloalto.md | 10 +++++----- .../configuration/networkdevices/sonicwall.md | 11 +++++------ .../configuration/networkdevices/ciscoasa.md | 16 +++++++--------- .../configuration/networkdevices/ciscoios.md | 16 ++++++++-------- .../networkdevices/fortinetfortigate.md | 4 ++-- .../10.9/configuration/networkdevices/juniper.md | 8 ++++---- .../configuration/networkdevices/paloalto.md | 12 ++++++------ .../configuration/networkdevices/sonicwall.md | 11 +++++------ 18 files changed, 94 insertions(+), 103 deletions(-) diff --git a/docs/auditor/10.7/configuration/networkdevices/ciscoasa.md b/docs/auditor/10.7/configuration/networkdevices/ciscoasa.md index af973098c5..9a15910af7 100644 --- a/docs/auditor/10.7/configuration/networkdevices/ciscoasa.md +++ b/docs/auditor/10.7/configuration/networkdevices/ciscoasa.md @@ -15,18 +15,18 @@ may contain warnings, errors, or incomplete audit data. [Antivirus Exclusions for Netwrix Auditor](/docs/kb/auditor/system-administration/security-hardening/antivirus-exclusions-for-netwrix-auditor) knowledge base article for additional information. -Configure native audit settings manually on the Cisco ASA device to ensure Netwrix Auditor -collects comprehensive and reliable audit data: +Netwrix Auditor can't push configuration changes to network devices, so configure native audit +settings manually on the Cisco ASA device. When you finish, the device has the following settings: -- Select the global configuration mode. -- Select the `logging enable` option on the Cisco ASA device. -- Set the `logging host` parameter to the host address of the audited Cisco ASA device, and use a +- The global configuration mode is enabled. +- The `logging enable` option is turned on. +- The `logging host` parameter is set to the host address of the audited Cisco ASA device, using a UDP port (for example, 514) to send messages. **NOTE:** Don't select the EMBLEM format logging for the syslog server option. -- Enable the `logging timestamp` option. -- Select the `logging trap` option from 1 to 6 inclusive. +- The `logging timestamp` option is enabled. +- The `logging trap` option is set from 1 to 6 inclusive. To configure your Cisco ASA devices, do the following: @@ -48,8 +48,6 @@ To configure your Cisco ASA devices, do the following: hostname(config)# logging host `` - Don't select the EMBLEM format logging for the syslog server option. - 5. Enable the `logging timestamp` option. For example: hostname(config)# logging timestamp diff --git a/docs/auditor/10.7/configuration/networkdevices/ciscoios.md b/docs/auditor/10.7/configuration/networkdevices/ciscoios.md index 1c2e5e5904..ea81e53c73 100644 --- a/docs/auditor/10.7/configuration/networkdevices/ciscoios.md +++ b/docs/auditor/10.7/configuration/networkdevices/ciscoios.md @@ -15,14 +15,14 @@ may contain warnings, errors, or incomplete audit data. [Antivirus Exclusions for Netwrix Auditor](/docs/kb/auditor/system-administration/security-hardening/antivirus-exclusions-for-netwrix-auditor) knowledge base article for additional information. -Configure native audit settings manually on the Cisco IOS device to ensure Netwrix Auditor -collects comprehensive and reliable audit data: - -- Select the global configuration mode. -- Enable the `logging timestamp` option. -- Select the `logging trap` option from 1 to 6 inclusive. -- Set the `logging host` parameter to the host address where you plan to install the service, and - use a UDP port (for example, 514) to send messages. +Netwrix Auditor can't push configuration changes to network devices, so configure native audit +settings manually on the Cisco IOS device. When you finish, the device has the following settings: + +- The global configuration mode is enabled. +- The `logging timestamp` option is enabled. +- The `logging trap` option is set from 1 to 6 inclusive. +- The `logging host` parameter is set to the host address of the computer that hosts Netwrix + Auditor Server, using a UDP port (for example, 514) to send messages. To configure your Cisco IOS devices, do the following: diff --git a/docs/auditor/10.7/configuration/networkdevices/fortinetfortigate.md b/docs/auditor/10.7/configuration/networkdevices/fortinetfortigate.md index 088cbf25e1..6866ce6b5c 100644 --- a/docs/auditor/10.7/configuration/networkdevices/fortinetfortigate.md +++ b/docs/auditor/10.7/configuration/networkdevices/fortinetfortigate.md @@ -15,8 +15,8 @@ may contain warnings, errors, or incomplete audit data. [Antivirus Exclusions for Netwrix Auditor](/docs/kb/auditor/system-administration/security-hardening/antivirus-exclusions-for-netwrix-auditor) knowledge base article for additional information. -Configure native audit settings manually on the Fortinet FortiGate device via Command Line -Interface (CLI) to ensure Netwrix Auditor collects comprehensive and reliable audit data. +Configure native audit settings manually on the Fortinet FortiGate device to ensure Netwrix +Auditor collects comprehensive and reliable audit data. To configure your Fortinet FortiGate devices, enable logging to multiple Syslog servers and configure FortiOS to send log messages to remote syslog servers in Common Event Format (CEF). Do diff --git a/docs/auditor/10.7/configuration/networkdevices/juniper.md b/docs/auditor/10.7/configuration/networkdevices/juniper.md index eeaa418521..ecfaf6df16 100644 --- a/docs/auditor/10.7/configuration/networkdevices/juniper.md +++ b/docs/auditor/10.7/configuration/networkdevices/juniper.md @@ -15,12 +15,12 @@ may contain warnings, errors, or incomplete audit data. [Antivirus Exclusions for Netwrix Auditor](/docs/kb/auditor/system-administration/security-hardening/antivirus-exclusions-for-netwrix-auditor) knowledge base article for additional information. -Configure native audit settings manually on the Juniper device via JunOS Command Line -Interface (CLI) to ensure Netwrix Auditor collects comprehensive and reliable audit data. +Configure native audit settings manually on the Juniper device to ensure Netwrix Auditor collects +comprehensive and reliable audit data. -To configure you Juniper devices, do the following: +To configure your Juniper devices, do the following: -1. Launch the JunOS Command Line Interface (CLI). +1. Launch the Junos OS command line interface (CLI). 2. Execute the following commands: # configure diff --git a/docs/auditor/10.7/configuration/networkdevices/paloalto.md b/docs/auditor/10.7/configuration/networkdevices/paloalto.md index dfd2e04e7d..a18c952e4b 100644 --- a/docs/auditor/10.7/configuration/networkdevices/paloalto.md +++ b/docs/auditor/10.7/configuration/networkdevices/paloalto.md @@ -15,13 +15,13 @@ may contain warnings, errors, or incomplete audit data. [Antivirus Exclusions for Netwrix Auditor](/docs/kb/auditor/system-administration/security-hardening/antivirus-exclusions-for-netwrix-auditor) knowledge base article for additional information. -Configure native audit settings manually on the PaloAlto device via Web Interface to ensure +Configure native audit settings manually on the Palo Alto device via the web interface to ensure Netwrix Auditor collects comprehensive and reliable audit data. -To configure your PaloAlto devices, create a Syslog server profile and assign it to the log settings +To configure your Palo Alto devices, create a syslog server profile and assign it to the log settings for each log type. -## Configure a Syslog server profile +## Configure a syslog server profile **Step 1 –** Connect to your PaloAlto device: launch an Internet browser and enter the IP address of the firewall in the URL field (https://``). @@ -48,8 +48,8 @@ the firewall in the URL field (https://``). **Step 2 –** For System, Config, and User ID logs, click Add and enter unique name of your syslog server. -**Step 3 –** On the syslog panel, click Add and select the syslog profile you created in -[Configure a Syslog server profile](#configure-a-syslog-server-profile). +**Step 3 –** On the syslog panel, click Add and select the syslog server profile you created in +[Configure a syslog server profile](#configure-a-syslog-server-profile). **Step 4 –** Click **Commit** and review the logs on the syslog server. diff --git a/docs/auditor/10.7/configuration/networkdevices/sonicwall.md b/docs/auditor/10.7/configuration/networkdevices/sonicwall.md index cde4b4514a..d5b8357f25 100644 --- a/docs/auditor/10.7/configuration/networkdevices/sonicwall.md +++ b/docs/auditor/10.7/configuration/networkdevices/sonicwall.md @@ -16,8 +16,7 @@ may contain warnings, errors, or incomplete audit data. knowledge base article for additional information. Configure native audit settings manually on the SonicWall device to ensure Netwrix Auditor -collects comprehensive and reliable audit data. Configure log settings, depending on your device -type. +collects comprehensive and reliable audit data, adjusting the log settings for your device type. To configure your SonicWall devices, do the following: @@ -103,16 +102,16 @@ Review a full list of object types Netwrix Auditor can collect on SonicWall netw | Object type | Actions | Event ID | | ------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Logon | - Successful logon | - User login from an internal zone allowed - User login successful - XAUTH Succeeded with VPN - VPN zone remote user login allowed - WAN zone remote user login allowed - PPP: Authentication successful - Local Authentication Success - RADIUS/LDAP Authentication Success - Successful authentication received for Remotely Triggered - IKEv2 Authentication successful - SSL VPN zone remote user login allowed | -| - Failed logon | - User login denied - User login failed - XAUTH Failed with VPN - L2TP PPP Authentication Failed - check username / password - RADIUS/LDAP reports Authentication Failure - Local Authentication Failure - User log in to Administration Portal denied - User login failure rate exceeded - User Name authentication Failure locally - ISAKMP_AUTH_FAILED - Guest service limit reached - Guest login denied - Incorrect authentication received for Remotely Triggered - Authentication Timeout during Remotely Triggered - Problem occurred during user group membership retrieval - An error has occurred while sending your - IPsec Authentication Failed | | +| - Failed logon | - User login denied - User login failed - XAUTH Failed with VPN - L2TP PPP Authentication Failed - check username / password - RADIUS/LDAP reports Authentication Failure - Local Authentication Failure - User login to Administration Portal denied - User login failure rate exceeded - User Name authentication Failure locally - ISAKMP_AUTH_FAILED - Guest service limit reached - Guest login denied - Incorrect authentication received for Remotely Triggered - Authentication Timeout during Remotely Triggered - Problem occurred during user group membership retrieval - An error has occurred while sending your - IPsec Authentication Failed | | | - Logoff | - User logged out - logged out - Guest Session Timeout - Guest Account Timeout - Guest Idle Timeout - Guest traffic quota exceeded | | | Authentication | - Successful Logon | - Administrator login allowed - CLI administrator login allowed - VPN zone administrator login allowed - WAN zone administrator login allowed - Configuration mode administration session started - Read-only mode GUI administration session started - Non-config mode GUI administration session started - User login successful - Session Start: - EventMessage: Session Start Success | -| - Failed Logon | - Administrator login denied - CLI administrator login denied due to bad credentials - User login failed - The account has been disabled for - isn't permitted for this Web App - Authentication for user - Authentication failed - maximum authentication attempts exceeded for - EventMessage: Session Start Failed | | +| - Failed Logon | - Administrator login denied - CLI administrator login denied due to bad credentials - User login failed - The account has been disabled for - is not permitted for this Web App - Authentication for user - Authentication failed - maximum authentication attempts exceeded for - EventMessage: Session Start Failed | | | - Logoff | - Administrator logged out - CLI administrator logged out - Configuration mode administration session ended - GUI administration session ended - Logged out - Session End: - EventMessage: Session End - Command='Tunnel' | | | Configuration | - Add / Added (Failed attempt) | - m=1333 - Scheduled settings generated - A new default Self-Signed certificate was generated successfully - Scheduled Tech Support Report generated - Restarted Tech Support Report generated | | - Modified / Modify (Failed attempt) | - Mail attachment disabled - Watch and report possible SYN floods - Watch and proxy WAN connections when under attack - Always proxy WAN connections - SYN Flood blacklisting enabled by user - SYN Flood blacklisting disabled by user - Administrator name changed - VPN disabled by administrator - VPN enabled by administrator - WLAN disabled by administrator - WLAN enabled by administrator - WLAN disabled by schedule - WLAN enabled by schedule - is added into Group - is removed from Group - m=1334 - Update administrator/user lockout params - Settings imported - Critical Operating System Update failed - msg=\"WAF restarted - HTTP(S) Cache settings were updated - database has been updated - Web Server Fingerprint Protection enforced - About to reconfigure service: - Finished applying configuration changes - Started - Start failed - Stopped | | -| - Read / Read (Failed attempt) | - m=1203 - m=1204 - Problem loading the URL list - Registration Update Needed, restore your existing security service subscriptions - Failed to synchronize license information with Licensing Server - Current settings exported - Error sending - settings sent successfully - Automated scheduled settings successful - Scheduled settings downloaded - Tech Support Report - Tech Support Report sent successfully - Loaded WAF signature database successfully - Error sending - logs sent out successfully | | +| - Read / Read (Failed attempt) | - m=1203 - m=1204 - Problem loading the URL list - Registration Update Needed, Please restore your existing security service subscriptions - Failed to synchronize license information with Licensing Server - Current settings exported - Error sending - settings sent successfully - Automated scheduled settings successful - Scheduled settings downloaded - Tech Support Report - Tech Support Report sent successfully - Loaded WAF signature database successfully - Error sending - logs sent out successfully | | | | - Remove / Removed (Failed attempt) | - Scheduled settings deleted - Oldest scheduled Tech Support Report deleted - has been deleted - Event Logs cleared - Audit Logs cleared - Access Logs cleared - Deleting log files - Deleting core files - Deleting snapshots older | -| Device state | - Modified / Modify (Failed attempt) | - Registration Update Needed, restore your existing security service subscriptions - Intrusion Prevention (IDP) subscription has expired - Failed to synchronize license information with Licensing Server | +| Device state | - Modified / Modify (Failed attempt) | - Registration Update Needed, Please restore your existing security service subscriptions - Intrusion Prevention (IDP) subscription has expired - Failed to synchronize license information with Licensing Server | | Folder | - Add / Added (Failed attempt) | - Request='GET /cgi-bin/sonicfiles?RacNumber=9&Arg1= | | - Read / Read (Failed attempt) | - Request='GET /cgi-bin/sonicfiles?RacNumber=16&Arg1= | | | - Remove / Removed (Failed attempt) | - Request='GET /cgi-bin/sonicfiles?RacNumber=13&Arg1= | | diff --git a/docs/auditor/10.8/configuration/networkdevices/ciscoasa.md b/docs/auditor/10.8/configuration/networkdevices/ciscoasa.md index af973098c5..9a15910af7 100644 --- a/docs/auditor/10.8/configuration/networkdevices/ciscoasa.md +++ b/docs/auditor/10.8/configuration/networkdevices/ciscoasa.md @@ -15,18 +15,18 @@ may contain warnings, errors, or incomplete audit data. [Antivirus Exclusions for Netwrix Auditor](/docs/kb/auditor/system-administration/security-hardening/antivirus-exclusions-for-netwrix-auditor) knowledge base article for additional information. -Configure native audit settings manually on the Cisco ASA device to ensure Netwrix Auditor -collects comprehensive and reliable audit data: +Netwrix Auditor can't push configuration changes to network devices, so configure native audit +settings manually on the Cisco ASA device. When you finish, the device has the following settings: -- Select the global configuration mode. -- Select the `logging enable` option on the Cisco ASA device. -- Set the `logging host` parameter to the host address of the audited Cisco ASA device, and use a +- The global configuration mode is enabled. +- The `logging enable` option is turned on. +- The `logging host` parameter is set to the host address of the audited Cisco ASA device, using a UDP port (for example, 514) to send messages. **NOTE:** Don't select the EMBLEM format logging for the syslog server option. -- Enable the `logging timestamp` option. -- Select the `logging trap` option from 1 to 6 inclusive. +- The `logging timestamp` option is enabled. +- The `logging trap` option is set from 1 to 6 inclusive. To configure your Cisco ASA devices, do the following: @@ -48,8 +48,6 @@ To configure your Cisco ASA devices, do the following: hostname(config)# logging host `` - Don't select the EMBLEM format logging for the syslog server option. - 5. Enable the `logging timestamp` option. For example: hostname(config)# logging timestamp diff --git a/docs/auditor/10.8/configuration/networkdevices/ciscoios.md b/docs/auditor/10.8/configuration/networkdevices/ciscoios.md index 1c2e5e5904..ea81e53c73 100644 --- a/docs/auditor/10.8/configuration/networkdevices/ciscoios.md +++ b/docs/auditor/10.8/configuration/networkdevices/ciscoios.md @@ -15,14 +15,14 @@ may contain warnings, errors, or incomplete audit data. [Antivirus Exclusions for Netwrix Auditor](/docs/kb/auditor/system-administration/security-hardening/antivirus-exclusions-for-netwrix-auditor) knowledge base article for additional information. -Configure native audit settings manually on the Cisco IOS device to ensure Netwrix Auditor -collects comprehensive and reliable audit data: - -- Select the global configuration mode. -- Enable the `logging timestamp` option. -- Select the `logging trap` option from 1 to 6 inclusive. -- Set the `logging host` parameter to the host address where you plan to install the service, and - use a UDP port (for example, 514) to send messages. +Netwrix Auditor can't push configuration changes to network devices, so configure native audit +settings manually on the Cisco IOS device. When you finish, the device has the following settings: + +- The global configuration mode is enabled. +- The `logging timestamp` option is enabled. +- The `logging trap` option is set from 1 to 6 inclusive. +- The `logging host` parameter is set to the host address of the computer that hosts Netwrix + Auditor Server, using a UDP port (for example, 514) to send messages. To configure your Cisco IOS devices, do the following: diff --git a/docs/auditor/10.8/configuration/networkdevices/fortinetfortigate.md b/docs/auditor/10.8/configuration/networkdevices/fortinetfortigate.md index 088cbf25e1..6866ce6b5c 100644 --- a/docs/auditor/10.8/configuration/networkdevices/fortinetfortigate.md +++ b/docs/auditor/10.8/configuration/networkdevices/fortinetfortigate.md @@ -15,8 +15,8 @@ may contain warnings, errors, or incomplete audit data. [Antivirus Exclusions for Netwrix Auditor](/docs/kb/auditor/system-administration/security-hardening/antivirus-exclusions-for-netwrix-auditor) knowledge base article for additional information. -Configure native audit settings manually on the Fortinet FortiGate device via Command Line -Interface (CLI) to ensure Netwrix Auditor collects comprehensive and reliable audit data. +Configure native audit settings manually on the Fortinet FortiGate device to ensure Netwrix +Auditor collects comprehensive and reliable audit data. To configure your Fortinet FortiGate devices, enable logging to multiple Syslog servers and configure FortiOS to send log messages to remote syslog servers in Common Event Format (CEF). Do diff --git a/docs/auditor/10.8/configuration/networkdevices/juniper.md b/docs/auditor/10.8/configuration/networkdevices/juniper.md index 1f0da112da..57bba2f518 100644 --- a/docs/auditor/10.8/configuration/networkdevices/juniper.md +++ b/docs/auditor/10.8/configuration/networkdevices/juniper.md @@ -15,12 +15,12 @@ may contain warnings, errors, or incomplete audit data. [Antivirus Exclusions for Netwrix Auditor](/docs/kb/auditor/system-administration/security-hardening/antivirus-exclusions-for-netwrix-auditor) knowledge base article for additional information. -Configure native audit settings manually on the Juniper device via JunOS Command Line -Interface (CLI) to ensure Netwrix Auditor collects comprehensive and reliable audit data. +Configure native audit settings manually on the Juniper device to ensure Netwrix Auditor collects +comprehensive and reliable audit data. -To configure you Juniper devices, do the following: +To configure your Juniper devices, do the following: -1. Launch the JunOS Command Line Interface (CLI). +1. Launch the Junos OS command line interface (CLI). 2. Execute the following commands: # configure diff --git a/docs/auditor/10.8/configuration/networkdevices/paloalto.md b/docs/auditor/10.8/configuration/networkdevices/paloalto.md index dfd2e04e7d..a18c952e4b 100644 --- a/docs/auditor/10.8/configuration/networkdevices/paloalto.md +++ b/docs/auditor/10.8/configuration/networkdevices/paloalto.md @@ -15,13 +15,13 @@ may contain warnings, errors, or incomplete audit data. [Antivirus Exclusions for Netwrix Auditor](/docs/kb/auditor/system-administration/security-hardening/antivirus-exclusions-for-netwrix-auditor) knowledge base article for additional information. -Configure native audit settings manually on the PaloAlto device via Web Interface to ensure +Configure native audit settings manually on the Palo Alto device via the web interface to ensure Netwrix Auditor collects comprehensive and reliable audit data. -To configure your PaloAlto devices, create a Syslog server profile and assign it to the log settings +To configure your Palo Alto devices, create a syslog server profile and assign it to the log settings for each log type. -## Configure a Syslog server profile +## Configure a syslog server profile **Step 1 –** Connect to your PaloAlto device: launch an Internet browser and enter the IP address of the firewall in the URL field (https://``). @@ -48,8 +48,8 @@ the firewall in the URL field (https://``). **Step 2 –** For System, Config, and User ID logs, click Add and enter unique name of your syslog server. -**Step 3 –** On the syslog panel, click Add and select the syslog profile you created in -[Configure a Syslog server profile](#configure-a-syslog-server-profile). +**Step 3 –** On the syslog panel, click Add and select the syslog server profile you created in +[Configure a syslog server profile](#configure-a-syslog-server-profile). **Step 4 –** Click **Commit** and review the logs on the syslog server. diff --git a/docs/auditor/10.8/configuration/networkdevices/sonicwall.md b/docs/auditor/10.8/configuration/networkdevices/sonicwall.md index cde4b4514a..d5b8357f25 100644 --- a/docs/auditor/10.8/configuration/networkdevices/sonicwall.md +++ b/docs/auditor/10.8/configuration/networkdevices/sonicwall.md @@ -16,8 +16,7 @@ may contain warnings, errors, or incomplete audit data. knowledge base article for additional information. Configure native audit settings manually on the SonicWall device to ensure Netwrix Auditor -collects comprehensive and reliable audit data. Configure log settings, depending on your device -type. +collects comprehensive and reliable audit data, adjusting the log settings for your device type. To configure your SonicWall devices, do the following: @@ -103,16 +102,16 @@ Review a full list of object types Netwrix Auditor can collect on SonicWall netw | Object type | Actions | Event ID | | ------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Logon | - Successful logon | - User login from an internal zone allowed - User login successful - XAUTH Succeeded with VPN - VPN zone remote user login allowed - WAN zone remote user login allowed - PPP: Authentication successful - Local Authentication Success - RADIUS/LDAP Authentication Success - Successful authentication received for Remotely Triggered - IKEv2 Authentication successful - SSL VPN zone remote user login allowed | -| - Failed logon | - User login denied - User login failed - XAUTH Failed with VPN - L2TP PPP Authentication Failed - check username / password - RADIUS/LDAP reports Authentication Failure - Local Authentication Failure - User log in to Administration Portal denied - User login failure rate exceeded - User Name authentication Failure locally - ISAKMP_AUTH_FAILED - Guest service limit reached - Guest login denied - Incorrect authentication received for Remotely Triggered - Authentication Timeout during Remotely Triggered - Problem occurred during user group membership retrieval - An error has occurred while sending your - IPsec Authentication Failed | | +| - Failed logon | - User login denied - User login failed - XAUTH Failed with VPN - L2TP PPP Authentication Failed - check username / password - RADIUS/LDAP reports Authentication Failure - Local Authentication Failure - User login to Administration Portal denied - User login failure rate exceeded - User Name authentication Failure locally - ISAKMP_AUTH_FAILED - Guest service limit reached - Guest login denied - Incorrect authentication received for Remotely Triggered - Authentication Timeout during Remotely Triggered - Problem occurred during user group membership retrieval - An error has occurred while sending your - IPsec Authentication Failed | | | - Logoff | - User logged out - logged out - Guest Session Timeout - Guest Account Timeout - Guest Idle Timeout - Guest traffic quota exceeded | | | Authentication | - Successful Logon | - Administrator login allowed - CLI administrator login allowed - VPN zone administrator login allowed - WAN zone administrator login allowed - Configuration mode administration session started - Read-only mode GUI administration session started - Non-config mode GUI administration session started - User login successful - Session Start: - EventMessage: Session Start Success | -| - Failed Logon | - Administrator login denied - CLI administrator login denied due to bad credentials - User login failed - The account has been disabled for - isn't permitted for this Web App - Authentication for user - Authentication failed - maximum authentication attempts exceeded for - EventMessage: Session Start Failed | | +| - Failed Logon | - Administrator login denied - CLI administrator login denied due to bad credentials - User login failed - The account has been disabled for - is not permitted for this Web App - Authentication for user - Authentication failed - maximum authentication attempts exceeded for - EventMessage: Session Start Failed | | | - Logoff | - Administrator logged out - CLI administrator logged out - Configuration mode administration session ended - GUI administration session ended - Logged out - Session End: - EventMessage: Session End - Command='Tunnel' | | | Configuration | - Add / Added (Failed attempt) | - m=1333 - Scheduled settings generated - A new default Self-Signed certificate was generated successfully - Scheduled Tech Support Report generated - Restarted Tech Support Report generated | | - Modified / Modify (Failed attempt) | - Mail attachment disabled - Watch and report possible SYN floods - Watch and proxy WAN connections when under attack - Always proxy WAN connections - SYN Flood blacklisting enabled by user - SYN Flood blacklisting disabled by user - Administrator name changed - VPN disabled by administrator - VPN enabled by administrator - WLAN disabled by administrator - WLAN enabled by administrator - WLAN disabled by schedule - WLAN enabled by schedule - is added into Group - is removed from Group - m=1334 - Update administrator/user lockout params - Settings imported - Critical Operating System Update failed - msg=\"WAF restarted - HTTP(S) Cache settings were updated - database has been updated - Web Server Fingerprint Protection enforced - About to reconfigure service: - Finished applying configuration changes - Started - Start failed - Stopped | | -| - Read / Read (Failed attempt) | - m=1203 - m=1204 - Problem loading the URL list - Registration Update Needed, restore your existing security service subscriptions - Failed to synchronize license information with Licensing Server - Current settings exported - Error sending - settings sent successfully - Automated scheduled settings successful - Scheduled settings downloaded - Tech Support Report - Tech Support Report sent successfully - Loaded WAF signature database successfully - Error sending - logs sent out successfully | | +| - Read / Read (Failed attempt) | - m=1203 - m=1204 - Problem loading the URL list - Registration Update Needed, Please restore your existing security service subscriptions - Failed to synchronize license information with Licensing Server - Current settings exported - Error sending - settings sent successfully - Automated scheduled settings successful - Scheduled settings downloaded - Tech Support Report - Tech Support Report sent successfully - Loaded WAF signature database successfully - Error sending - logs sent out successfully | | | | - Remove / Removed (Failed attempt) | - Scheduled settings deleted - Oldest scheduled Tech Support Report deleted - has been deleted - Event Logs cleared - Audit Logs cleared - Access Logs cleared - Deleting log files - Deleting core files - Deleting snapshots older | -| Device state | - Modified / Modify (Failed attempt) | - Registration Update Needed, restore your existing security service subscriptions - Intrusion Prevention (IDP) subscription has expired - Failed to synchronize license information with Licensing Server | +| Device state | - Modified / Modify (Failed attempt) | - Registration Update Needed, Please restore your existing security service subscriptions - Intrusion Prevention (IDP) subscription has expired - Failed to synchronize license information with Licensing Server | | Folder | - Add / Added (Failed attempt) | - Request='GET /cgi-bin/sonicfiles?RacNumber=9&Arg1= | | - Read / Read (Failed attempt) | - Request='GET /cgi-bin/sonicfiles?RacNumber=16&Arg1= | | | - Remove / Removed (Failed attempt) | - Request='GET /cgi-bin/sonicfiles?RacNumber=13&Arg1= | | diff --git a/docs/auditor/10.9/configuration/networkdevices/ciscoasa.md b/docs/auditor/10.9/configuration/networkdevices/ciscoasa.md index af973098c5..9a15910af7 100644 --- a/docs/auditor/10.9/configuration/networkdevices/ciscoasa.md +++ b/docs/auditor/10.9/configuration/networkdevices/ciscoasa.md @@ -15,18 +15,18 @@ may contain warnings, errors, or incomplete audit data. [Antivirus Exclusions for Netwrix Auditor](/docs/kb/auditor/system-administration/security-hardening/antivirus-exclusions-for-netwrix-auditor) knowledge base article for additional information. -Configure native audit settings manually on the Cisco ASA device to ensure Netwrix Auditor -collects comprehensive and reliable audit data: +Netwrix Auditor can't push configuration changes to network devices, so configure native audit +settings manually on the Cisco ASA device. When you finish, the device has the following settings: -- Select the global configuration mode. -- Select the `logging enable` option on the Cisco ASA device. -- Set the `logging host` parameter to the host address of the audited Cisco ASA device, and use a +- The global configuration mode is enabled. +- The `logging enable` option is turned on. +- The `logging host` parameter is set to the host address of the audited Cisco ASA device, using a UDP port (for example, 514) to send messages. **NOTE:** Don't select the EMBLEM format logging for the syslog server option. -- Enable the `logging timestamp` option. -- Select the `logging trap` option from 1 to 6 inclusive. +- The `logging timestamp` option is enabled. +- The `logging trap` option is set from 1 to 6 inclusive. To configure your Cisco ASA devices, do the following: @@ -48,8 +48,6 @@ To configure your Cisco ASA devices, do the following: hostname(config)# logging host `` - Don't select the EMBLEM format logging for the syslog server option. - 5. Enable the `logging timestamp` option. For example: hostname(config)# logging timestamp diff --git a/docs/auditor/10.9/configuration/networkdevices/ciscoios.md b/docs/auditor/10.9/configuration/networkdevices/ciscoios.md index 1c2e5e5904..ea81e53c73 100644 --- a/docs/auditor/10.9/configuration/networkdevices/ciscoios.md +++ b/docs/auditor/10.9/configuration/networkdevices/ciscoios.md @@ -15,14 +15,14 @@ may contain warnings, errors, or incomplete audit data. [Antivirus Exclusions for Netwrix Auditor](/docs/kb/auditor/system-administration/security-hardening/antivirus-exclusions-for-netwrix-auditor) knowledge base article for additional information. -Configure native audit settings manually on the Cisco IOS device to ensure Netwrix Auditor -collects comprehensive and reliable audit data: - -- Select the global configuration mode. -- Enable the `logging timestamp` option. -- Select the `logging trap` option from 1 to 6 inclusive. -- Set the `logging host` parameter to the host address where you plan to install the service, and - use a UDP port (for example, 514) to send messages. +Netwrix Auditor can't push configuration changes to network devices, so configure native audit +settings manually on the Cisco IOS device. When you finish, the device has the following settings: + +- The global configuration mode is enabled. +- The `logging timestamp` option is enabled. +- The `logging trap` option is set from 1 to 6 inclusive. +- The `logging host` parameter is set to the host address of the computer that hosts Netwrix + Auditor Server, using a UDP port (for example, 514) to send messages. To configure your Cisco IOS devices, do the following: diff --git a/docs/auditor/10.9/configuration/networkdevices/fortinetfortigate.md b/docs/auditor/10.9/configuration/networkdevices/fortinetfortigate.md index 088cbf25e1..6866ce6b5c 100644 --- a/docs/auditor/10.9/configuration/networkdevices/fortinetfortigate.md +++ b/docs/auditor/10.9/configuration/networkdevices/fortinetfortigate.md @@ -15,8 +15,8 @@ may contain warnings, errors, or incomplete audit data. [Antivirus Exclusions for Netwrix Auditor](/docs/kb/auditor/system-administration/security-hardening/antivirus-exclusions-for-netwrix-auditor) knowledge base article for additional information. -Configure native audit settings manually on the Fortinet FortiGate device via Command Line -Interface (CLI) to ensure Netwrix Auditor collects comprehensive and reliable audit data. +Configure native audit settings manually on the Fortinet FortiGate device to ensure Netwrix +Auditor collects comprehensive and reliable audit data. To configure your Fortinet FortiGate devices, enable logging to multiple Syslog servers and configure FortiOS to send log messages to remote syslog servers in Common Event Format (CEF). Do diff --git a/docs/auditor/10.9/configuration/networkdevices/juniper.md b/docs/auditor/10.9/configuration/networkdevices/juniper.md index 15c204ace0..d482e61641 100644 --- a/docs/auditor/10.9/configuration/networkdevices/juniper.md +++ b/docs/auditor/10.9/configuration/networkdevices/juniper.md @@ -15,12 +15,12 @@ may contain warnings, errors, or incomplete audit data. [Antivirus Exclusions for Netwrix Auditor](/docs/kb/auditor/system-administration/security-hardening/antivirus-exclusions-for-netwrix-auditor) knowledge base article for additional information. -Configure native audit settings manually on the Juniper device via JunOS Command Line -Interface (CLI) to ensure Netwrix Auditor collects comprehensive and reliable audit data. +Configure native audit settings manually on the Juniper device to ensure Netwrix Auditor collects +comprehensive and reliable audit data. -To configure you Juniper devices, do the following: +To configure your Juniper devices, do the following: -1. Launch the JunOS Command Line Interface (CLI). +1. Launch the Junos OS command line interface (CLI). 2. Execute the following commands: # configure diff --git a/docs/auditor/10.9/configuration/networkdevices/paloalto.md b/docs/auditor/10.9/configuration/networkdevices/paloalto.md index dfd2e04e7d..bf5a7a2d17 100644 --- a/docs/auditor/10.9/configuration/networkdevices/paloalto.md +++ b/docs/auditor/10.9/configuration/networkdevices/paloalto.md @@ -15,13 +15,13 @@ may contain warnings, errors, or incomplete audit data. [Antivirus Exclusions for Netwrix Auditor](/docs/kb/auditor/system-administration/security-hardening/antivirus-exclusions-for-netwrix-auditor) knowledge base article for additional information. -Configure native audit settings manually on the PaloAlto device via Web Interface to ensure +Configure native audit settings manually on the Palo Alto device via the web interface to ensure Netwrix Auditor collects comprehensive and reliable audit data. -To configure your PaloAlto devices, create a Syslog server profile and assign it to the log settings -for each log type. +To configure your Palo Alto devices, create a syslog server profile and assign it to the log +settings for each log type. -## Configure a Syslog server profile +## Configure a syslog server profile **Step 1 –** Connect to your PaloAlto device: launch an Internet browser and enter the IP address of the firewall in the URL field (https://``). @@ -48,8 +48,8 @@ the firewall in the URL field (https://``). **Step 2 –** For System, Config, and User ID logs, click Add and enter unique name of your syslog server. -**Step 3 –** On the syslog panel, click Add and select the syslog profile you created in -[Configure a Syslog server profile](#configure-a-syslog-server-profile). +**Step 3 –** On the syslog panel, click Add and select the syslog server profile you created in +[Configure a syslog server profile](#configure-a-syslog-server-profile). **Step 4 –** Click **Commit** and review the logs on the syslog server. diff --git a/docs/auditor/10.9/configuration/networkdevices/sonicwall.md b/docs/auditor/10.9/configuration/networkdevices/sonicwall.md index cde4b4514a..d5b8357f25 100644 --- a/docs/auditor/10.9/configuration/networkdevices/sonicwall.md +++ b/docs/auditor/10.9/configuration/networkdevices/sonicwall.md @@ -16,8 +16,7 @@ may contain warnings, errors, or incomplete audit data. knowledge base article for additional information. Configure native audit settings manually on the SonicWall device to ensure Netwrix Auditor -collects comprehensive and reliable audit data. Configure log settings, depending on your device -type. +collects comprehensive and reliable audit data, adjusting the log settings for your device type. To configure your SonicWall devices, do the following: @@ -103,16 +102,16 @@ Review a full list of object types Netwrix Auditor can collect on SonicWall netw | Object type | Actions | Event ID | | ------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Logon | - Successful logon | - User login from an internal zone allowed - User login successful - XAUTH Succeeded with VPN - VPN zone remote user login allowed - WAN zone remote user login allowed - PPP: Authentication successful - Local Authentication Success - RADIUS/LDAP Authentication Success - Successful authentication received for Remotely Triggered - IKEv2 Authentication successful - SSL VPN zone remote user login allowed | -| - Failed logon | - User login denied - User login failed - XAUTH Failed with VPN - L2TP PPP Authentication Failed - check username / password - RADIUS/LDAP reports Authentication Failure - Local Authentication Failure - User log in to Administration Portal denied - User login failure rate exceeded - User Name authentication Failure locally - ISAKMP_AUTH_FAILED - Guest service limit reached - Guest login denied - Incorrect authentication received for Remotely Triggered - Authentication Timeout during Remotely Triggered - Problem occurred during user group membership retrieval - An error has occurred while sending your - IPsec Authentication Failed | | +| - Failed logon | - User login denied - User login failed - XAUTH Failed with VPN - L2TP PPP Authentication Failed - check username / password - RADIUS/LDAP reports Authentication Failure - Local Authentication Failure - User login to Administration Portal denied - User login failure rate exceeded - User Name authentication Failure locally - ISAKMP_AUTH_FAILED - Guest service limit reached - Guest login denied - Incorrect authentication received for Remotely Triggered - Authentication Timeout during Remotely Triggered - Problem occurred during user group membership retrieval - An error has occurred while sending your - IPsec Authentication Failed | | | - Logoff | - User logged out - logged out - Guest Session Timeout - Guest Account Timeout - Guest Idle Timeout - Guest traffic quota exceeded | | | Authentication | - Successful Logon | - Administrator login allowed - CLI administrator login allowed - VPN zone administrator login allowed - WAN zone administrator login allowed - Configuration mode administration session started - Read-only mode GUI administration session started - Non-config mode GUI administration session started - User login successful - Session Start: - EventMessage: Session Start Success | -| - Failed Logon | - Administrator login denied - CLI administrator login denied due to bad credentials - User login failed - The account has been disabled for - isn't permitted for this Web App - Authentication for user - Authentication failed - maximum authentication attempts exceeded for - EventMessage: Session Start Failed | | +| - Failed Logon | - Administrator login denied - CLI administrator login denied due to bad credentials - User login failed - The account has been disabled for - is not permitted for this Web App - Authentication for user - Authentication failed - maximum authentication attempts exceeded for - EventMessage: Session Start Failed | | | - Logoff | - Administrator logged out - CLI administrator logged out - Configuration mode administration session ended - GUI administration session ended - Logged out - Session End: - EventMessage: Session End - Command='Tunnel' | | | Configuration | - Add / Added (Failed attempt) | - m=1333 - Scheduled settings generated - A new default Self-Signed certificate was generated successfully - Scheduled Tech Support Report generated - Restarted Tech Support Report generated | | - Modified / Modify (Failed attempt) | - Mail attachment disabled - Watch and report possible SYN floods - Watch and proxy WAN connections when under attack - Always proxy WAN connections - SYN Flood blacklisting enabled by user - SYN Flood blacklisting disabled by user - Administrator name changed - VPN disabled by administrator - VPN enabled by administrator - WLAN disabled by administrator - WLAN enabled by administrator - WLAN disabled by schedule - WLAN enabled by schedule - is added into Group - is removed from Group - m=1334 - Update administrator/user lockout params - Settings imported - Critical Operating System Update failed - msg=\"WAF restarted - HTTP(S) Cache settings were updated - database has been updated - Web Server Fingerprint Protection enforced - About to reconfigure service: - Finished applying configuration changes - Started - Start failed - Stopped | | -| - Read / Read (Failed attempt) | - m=1203 - m=1204 - Problem loading the URL list - Registration Update Needed, restore your existing security service subscriptions - Failed to synchronize license information with Licensing Server - Current settings exported - Error sending - settings sent successfully - Automated scheduled settings successful - Scheduled settings downloaded - Tech Support Report - Tech Support Report sent successfully - Loaded WAF signature database successfully - Error sending - logs sent out successfully | | +| - Read / Read (Failed attempt) | - m=1203 - m=1204 - Problem loading the URL list - Registration Update Needed, Please restore your existing security service subscriptions - Failed to synchronize license information with Licensing Server - Current settings exported - Error sending - settings sent successfully - Automated scheduled settings successful - Scheduled settings downloaded - Tech Support Report - Tech Support Report sent successfully - Loaded WAF signature database successfully - Error sending - logs sent out successfully | | | | - Remove / Removed (Failed attempt) | - Scheduled settings deleted - Oldest scheduled Tech Support Report deleted - has been deleted - Event Logs cleared - Audit Logs cleared - Access Logs cleared - Deleting log files - Deleting core files - Deleting snapshots older | -| Device state | - Modified / Modify (Failed attempt) | - Registration Update Needed, restore your existing security service subscriptions - Intrusion Prevention (IDP) subscription has expired - Failed to synchronize license information with Licensing Server | +| Device state | - Modified / Modify (Failed attempt) | - Registration Update Needed, Please restore your existing security service subscriptions - Intrusion Prevention (IDP) subscription has expired - Failed to synchronize license information with Licensing Server | | Folder | - Add / Added (Failed attempt) | - Request='GET /cgi-bin/sonicfiles?RacNumber=9&Arg1= | | - Read / Read (Failed attempt) | - Request='GET /cgi-bin/sonicfiles?RacNumber=16&Arg1= | | | - Remove / Removed (Failed attempt) | - Request='GET /cgi-bin/sonicfiles?RacNumber=13&Arg1= | | From 3d3ea6662a93fcb1ef780f42938166263499c34b Mon Sep 17 00:00:00 2001 From: TheCat Date: Tue, 18 Aug 2026 21:25:53 +0100 Subject: [PATCH 6/9] paloalto.md: merge duplicated intro clause The intro had two adjacent sentences both stating the device is configured manually ('Configure native audit settings manually on the Palo Alto device...' followed by 'To configure your Palo Alto devices, create a syslog server profile...'). Merged into one sentence. All other items from the last editorial review (ciscoasa.md, ciscoios.md, fortinetfortigate.md, juniper.md, sonicwall.md) were already addressed in b8200f005; verified against the original pre-autofix content and confirmed intact. Applied to Auditor 10.7, 10.8, and 10.9. Co-Authored-By: Claude Sonnet 5 --- .../auditor/10.7/configuration/networkdevices/paloalto.md | 8 +++----- .../auditor/10.8/configuration/networkdevices/paloalto.md | 8 +++----- .../auditor/10.9/configuration/networkdevices/paloalto.md | 8 +++----- 3 files changed, 9 insertions(+), 15 deletions(-) diff --git a/docs/auditor/10.7/configuration/networkdevices/paloalto.md b/docs/auditor/10.7/configuration/networkdevices/paloalto.md index a18c952e4b..e94484cd19 100644 --- a/docs/auditor/10.7/configuration/networkdevices/paloalto.md +++ b/docs/auditor/10.7/configuration/networkdevices/paloalto.md @@ -15,11 +15,9 @@ may contain warnings, errors, or incomplete audit data. [Antivirus Exclusions for Netwrix Auditor](/docs/kb/auditor/system-administration/security-hardening/antivirus-exclusions-for-netwrix-auditor) knowledge base article for additional information. -Configure native audit settings manually on the Palo Alto device via the web interface to ensure -Netwrix Auditor collects comprehensive and reliable audit data. - -To configure your Palo Alto devices, create a syslog server profile and assign it to the log settings -for each log type. +Configure native audit settings manually on the Palo Alto device via the web interface: create a +syslog server profile and assign it to the log settings for each log type to ensure Netwrix +Auditor collects comprehensive and reliable audit data. ## Configure a syslog server profile diff --git a/docs/auditor/10.8/configuration/networkdevices/paloalto.md b/docs/auditor/10.8/configuration/networkdevices/paloalto.md index a18c952e4b..e94484cd19 100644 --- a/docs/auditor/10.8/configuration/networkdevices/paloalto.md +++ b/docs/auditor/10.8/configuration/networkdevices/paloalto.md @@ -15,11 +15,9 @@ may contain warnings, errors, or incomplete audit data. [Antivirus Exclusions for Netwrix Auditor](/docs/kb/auditor/system-administration/security-hardening/antivirus-exclusions-for-netwrix-auditor) knowledge base article for additional information. -Configure native audit settings manually on the Palo Alto device via the web interface to ensure -Netwrix Auditor collects comprehensive and reliable audit data. - -To configure your Palo Alto devices, create a syslog server profile and assign it to the log settings -for each log type. +Configure native audit settings manually on the Palo Alto device via the web interface: create a +syslog server profile and assign it to the log settings for each log type to ensure Netwrix +Auditor collects comprehensive and reliable audit data. ## Configure a syslog server profile diff --git a/docs/auditor/10.9/configuration/networkdevices/paloalto.md b/docs/auditor/10.9/configuration/networkdevices/paloalto.md index bf5a7a2d17..e94484cd19 100644 --- a/docs/auditor/10.9/configuration/networkdevices/paloalto.md +++ b/docs/auditor/10.9/configuration/networkdevices/paloalto.md @@ -15,11 +15,9 @@ may contain warnings, errors, or incomplete audit data. [Antivirus Exclusions for Netwrix Auditor](/docs/kb/auditor/system-administration/security-hardening/antivirus-exclusions-for-netwrix-auditor) knowledge base article for additional information. -Configure native audit settings manually on the Palo Alto device via the web interface to ensure -Netwrix Auditor collects comprehensive and reliable audit data. - -To configure your Palo Alto devices, create a syslog server profile and assign it to the log -settings for each log type. +Configure native audit settings manually on the Palo Alto device via the web interface: create a +syslog server profile and assign it to the log settings for each log type to ensure Netwrix +Auditor collects comprehensive and reliable audit data. ## Configure a syslog server profile From 3ad76e3d48d507bbd4a113dde08f429a60075107 Mon Sep 17 00:00:00 2001 From: "claude[bot]" <41898282+claude[bot]@users.noreply.github.com> Date: Tue, 18 Aug 2026 20:38:46 +0000 Subject: [PATCH 7/9] fix(vale): auto-fix style issues (Vale + Dale) --- .../10.7/configuration/networkdevices/ciscoasa.md | 6 +++--- .../10.7/configuration/networkdevices/ciscoios.md | 6 +++--- .../10.7/configuration/networkdevices/juniper.md | 4 ++-- .../10.7/configuration/networkdevices/paloalto.md | 6 +++--- .../10.7/configuration/networkdevices/sonicwall.md | 10 +++++----- .../10.8/configuration/networkdevices/ciscoasa.md | 6 +++--- .../10.8/configuration/networkdevices/ciscoios.md | 6 +++--- .../10.8/configuration/networkdevices/juniper.md | 4 ++-- .../10.8/configuration/networkdevices/paloalto.md | 6 +++--- .../10.8/configuration/networkdevices/sonicwall.md | 10 +++++----- .../10.9/configuration/networkdevices/ciscoasa.md | 6 +++--- .../10.9/configuration/networkdevices/ciscoios.md | 6 +++--- .../10.9/configuration/networkdevices/juniper.md | 4 ++-- .../10.9/configuration/networkdevices/paloalto.md | 6 +++--- .../10.9/configuration/networkdevices/sonicwall.md | 10 +++++----- 15 files changed, 48 insertions(+), 48 deletions(-) diff --git a/docs/auditor/10.7/configuration/networkdevices/ciscoasa.md b/docs/auditor/10.7/configuration/networkdevices/ciscoasa.md index 9a15910af7..357b90b67d 100644 --- a/docs/auditor/10.7/configuration/networkdevices/ciscoasa.md +++ b/docs/auditor/10.7/configuration/networkdevices/ciscoasa.md @@ -20,13 +20,13 @@ settings manually on the Cisco ASA device. When you finish, the device has the f - The global configuration mode is enabled. - The `logging enable` option is turned on. -- The `logging host` parameter is set to the host address of the audited Cisco ASA device, using a - UDP port (for example, 514) to send messages. +- The `logging host` parameter specifies the host address of the audited Cisco ASA device, and the + device uses a UDP port (for example, 514) to send messages. **NOTE:** Don't select the EMBLEM format logging for the syslog server option. - The `logging timestamp` option is enabled. -- The `logging trap` option is set from 1 to 6 inclusive. +- The `logging trap` option uses a value from 1 to 6 inclusive. To configure your Cisco ASA devices, do the following: diff --git a/docs/auditor/10.7/configuration/networkdevices/ciscoios.md b/docs/auditor/10.7/configuration/networkdevices/ciscoios.md index ea81e53c73..bd75b3f764 100644 --- a/docs/auditor/10.7/configuration/networkdevices/ciscoios.md +++ b/docs/auditor/10.7/configuration/networkdevices/ciscoios.md @@ -20,9 +20,9 @@ settings manually on the Cisco IOS device. When you finish, the device has the f - The global configuration mode is enabled. - The `logging timestamp` option is enabled. -- The `logging trap` option is set from 1 to 6 inclusive. -- The `logging host` parameter is set to the host address of the computer that hosts Netwrix - Auditor Server, using a UDP port (for example, 514) to send messages. +- The `logging trap` option uses a value from 1 to 6 inclusive. +- The `logging host` parameter specifies the host address of the computer that hosts Netwrix + Auditor Server, and the device uses a UDP port (for example, 514) to send messages. To configure your Cisco IOS devices, do the following: diff --git a/docs/auditor/10.7/configuration/networkdevices/juniper.md b/docs/auditor/10.7/configuration/networkdevices/juniper.md index ecfaf6df16..7faf4b7b1f 100644 --- a/docs/auditor/10.7/configuration/networkdevices/juniper.md +++ b/docs/auditor/10.7/configuration/networkdevices/juniper.md @@ -37,8 +37,8 @@ To configure your Juniper devices, do the following: AND - `` is the name of the UDP port used to listen to network devices (514 port used by - default). [Network Devices](/docs/auditor/10.7/admin/monitoringplans/networkdevices.md) + `` is the name of the UDP port that Netwrix Auditor uses to listen to network + devices (port 514 by default). [Network Devices](/docs/auditor/10.7/admin/monitoringplans/networkdevices.md) # set system syslog time-format `` diff --git a/docs/auditor/10.7/configuration/networkdevices/paloalto.md b/docs/auditor/10.7/configuration/networkdevices/paloalto.md index e94484cd19..41a8e9a858 100644 --- a/docs/auditor/10.7/configuration/networkdevices/paloalto.md +++ b/docs/auditor/10.7/configuration/networkdevices/paloalto.md @@ -15,9 +15,9 @@ may contain warnings, errors, or incomplete audit data. [Antivirus Exclusions for Netwrix Auditor](/docs/kb/auditor/system-administration/security-hardening/antivirus-exclusions-for-netwrix-auditor) knowledge base article for additional information. -Configure native audit settings manually on the Palo Alto device via the web interface: create a -syslog server profile and assign it to the log settings for each log type to ensure Netwrix -Auditor collects comprehensive and reliable audit data. +Configure native audit settings manually on the Palo Alto device via the web interface to ensure +Netwrix Auditor collects comprehensive and reliable audit data. Create a syslog server profile and +assign it to the log settings for each log type. ## Configure a syslog server profile diff --git a/docs/auditor/10.7/configuration/networkdevices/sonicwall.md b/docs/auditor/10.7/configuration/networkdevices/sonicwall.md index d5b8357f25..a1f8c4253d 100644 --- a/docs/auditor/10.7/configuration/networkdevices/sonicwall.md +++ b/docs/auditor/10.7/configuration/networkdevices/sonicwall.md @@ -16,7 +16,7 @@ may contain warnings, errors, or incomplete audit data. knowledge base article for additional information. Configure native audit settings manually on the SonicWall device to ensure Netwrix Auditor -collects comprehensive and reliable audit data, adjusting the log settings for your device type. +collects comprehensive and reliable audit data. Adjust the log settings for your device type. To configure your SonicWall devices, do the following: @@ -102,16 +102,16 @@ Review a full list of object types Netwrix Auditor can collect on SonicWall netw | Object type | Actions | Event ID | | ------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Logon | - Successful logon | - User login from an internal zone allowed - User login successful - XAUTH Succeeded with VPN - VPN zone remote user login allowed - WAN zone remote user login allowed - PPP: Authentication successful - Local Authentication Success - RADIUS/LDAP Authentication Success - Successful authentication received for Remotely Triggered - IKEv2 Authentication successful - SSL VPN zone remote user login allowed | -| - Failed logon | - User login denied - User login failed - XAUTH Failed with VPN - L2TP PPP Authentication Failed - check username / password - RADIUS/LDAP reports Authentication Failure - Local Authentication Failure - User login to Administration Portal denied - User login failure rate exceeded - User Name authentication Failure locally - ISAKMP_AUTH_FAILED - Guest service limit reached - Guest login denied - Incorrect authentication received for Remotely Triggered - Authentication Timeout during Remotely Triggered - Problem occurred during user group membership retrieval - An error has occurred while sending your - IPsec Authentication Failed | | +| - Failed logon | - User login denied - User login failed - XAUTH Failed with VPN - L2TP PPP Authentication Failed - check username / password - RADIUS/LDAP reports Authentication Failure - Local Authentication Failure - User log in to Administration Portal denied - User login failure rate exceeded - User Name authentication Failure locally - ISAKMP_AUTH_FAILED - Guest service limit reached - Guest login denied - Incorrect authentication received for Remotely Triggered - Authentication Timeout during Remotely Triggered - Problem occurred during user group membership retrieval - An error has occurred while sending your - IPsec Authentication Failed | | | - Logoff | - User logged out - logged out - Guest Session Timeout - Guest Account Timeout - Guest Idle Timeout - Guest traffic quota exceeded | | | Authentication | - Successful Logon | - Administrator login allowed - CLI administrator login allowed - VPN zone administrator login allowed - WAN zone administrator login allowed - Configuration mode administration session started - Read-only mode GUI administration session started - Non-config mode GUI administration session started - User login successful - Session Start: - EventMessage: Session Start Success | -| - Failed Logon | - Administrator login denied - CLI administrator login denied due to bad credentials - User login failed - The account has been disabled for - is not permitted for this Web App - Authentication for user - Authentication failed - maximum authentication attempts exceeded for - EventMessage: Session Start Failed | | +| - Failed Logon | - Administrator login denied - CLI administrator login denied due to bad credentials - User login failed - The account has been disabled for - isn't permitted for this Web App - Authentication for user - Authentication failed - maximum authentication attempts exceeded for - EventMessage: Session Start Failed | | | - Logoff | - Administrator logged out - CLI administrator logged out - Configuration mode administration session ended - GUI administration session ended - Logged out - Session End: - EventMessage: Session End - Command='Tunnel' | | | Configuration | - Add / Added (Failed attempt) | - m=1333 - Scheduled settings generated - A new default Self-Signed certificate was generated successfully - Scheduled Tech Support Report generated - Restarted Tech Support Report generated | | - Modified / Modify (Failed attempt) | - Mail attachment disabled - Watch and report possible SYN floods - Watch and proxy WAN connections when under attack - Always proxy WAN connections - SYN Flood blacklisting enabled by user - SYN Flood blacklisting disabled by user - Administrator name changed - VPN disabled by administrator - VPN enabled by administrator - WLAN disabled by administrator - WLAN enabled by administrator - WLAN disabled by schedule - WLAN enabled by schedule - is added into Group - is removed from Group - m=1334 - Update administrator/user lockout params - Settings imported - Critical Operating System Update failed - msg=\"WAF restarted - HTTP(S) Cache settings were updated - database has been updated - Web Server Fingerprint Protection enforced - About to reconfigure service: - Finished applying configuration changes - Started - Start failed - Stopped | | -| - Read / Read (Failed attempt) | - m=1203 - m=1204 - Problem loading the URL list - Registration Update Needed, Please restore your existing security service subscriptions - Failed to synchronize license information with Licensing Server - Current settings exported - Error sending - settings sent successfully - Automated scheduled settings successful - Scheduled settings downloaded - Tech Support Report - Tech Support Report sent successfully - Loaded WAF signature database successfully - Error sending - logs sent out successfully | | +| - Read / Read (Failed attempt) | - m=1203 - m=1204 - Problem loading the URL list - Registration Update Needed, restore your existing security service subscriptions - Failed to synchronize license information with Licensing Server - Current settings exported - Error sending - settings sent successfully - Automated scheduled settings successful - Scheduled settings downloaded - Tech Support Report - Tech Support Report sent successfully - Loaded WAF signature database successfully - Error sending - logs sent out successfully | | | | - Remove / Removed (Failed attempt) | - Scheduled settings deleted - Oldest scheduled Tech Support Report deleted - has been deleted - Event Logs cleared - Audit Logs cleared - Access Logs cleared - Deleting log files - Deleting core files - Deleting snapshots older | -| Device state | - Modified / Modify (Failed attempt) | - Registration Update Needed, Please restore your existing security service subscriptions - Intrusion Prevention (IDP) subscription has expired - Failed to synchronize license information with Licensing Server | +| Device state | - Modified / Modify (Failed attempt) | - Registration Update Needed, restore your existing security service subscriptions - Intrusion Prevention (IDP) subscription has expired - Failed to synchronize license information with Licensing Server | | Folder | - Add / Added (Failed attempt) | - Request='GET /cgi-bin/sonicfiles?RacNumber=9&Arg1= | | - Read / Read (Failed attempt) | - Request='GET /cgi-bin/sonicfiles?RacNumber=16&Arg1= | | | - Remove / Removed (Failed attempt) | - Request='GET /cgi-bin/sonicfiles?RacNumber=13&Arg1= | | diff --git a/docs/auditor/10.8/configuration/networkdevices/ciscoasa.md b/docs/auditor/10.8/configuration/networkdevices/ciscoasa.md index 9a15910af7..357b90b67d 100644 --- a/docs/auditor/10.8/configuration/networkdevices/ciscoasa.md +++ b/docs/auditor/10.8/configuration/networkdevices/ciscoasa.md @@ -20,13 +20,13 @@ settings manually on the Cisco ASA device. When you finish, the device has the f - The global configuration mode is enabled. - The `logging enable` option is turned on. -- The `logging host` parameter is set to the host address of the audited Cisco ASA device, using a - UDP port (for example, 514) to send messages. +- The `logging host` parameter specifies the host address of the audited Cisco ASA device, and the + device uses a UDP port (for example, 514) to send messages. **NOTE:** Don't select the EMBLEM format logging for the syslog server option. - The `logging timestamp` option is enabled. -- The `logging trap` option is set from 1 to 6 inclusive. +- The `logging trap` option uses a value from 1 to 6 inclusive. To configure your Cisco ASA devices, do the following: diff --git a/docs/auditor/10.8/configuration/networkdevices/ciscoios.md b/docs/auditor/10.8/configuration/networkdevices/ciscoios.md index ea81e53c73..bd75b3f764 100644 --- a/docs/auditor/10.8/configuration/networkdevices/ciscoios.md +++ b/docs/auditor/10.8/configuration/networkdevices/ciscoios.md @@ -20,9 +20,9 @@ settings manually on the Cisco IOS device. When you finish, the device has the f - The global configuration mode is enabled. - The `logging timestamp` option is enabled. -- The `logging trap` option is set from 1 to 6 inclusive. -- The `logging host` parameter is set to the host address of the computer that hosts Netwrix - Auditor Server, using a UDP port (for example, 514) to send messages. +- The `logging trap` option uses a value from 1 to 6 inclusive. +- The `logging host` parameter specifies the host address of the computer that hosts Netwrix + Auditor Server, and the device uses a UDP port (for example, 514) to send messages. To configure your Cisco IOS devices, do the following: diff --git a/docs/auditor/10.8/configuration/networkdevices/juniper.md b/docs/auditor/10.8/configuration/networkdevices/juniper.md index 57bba2f518..8d665dbb4d 100644 --- a/docs/auditor/10.8/configuration/networkdevices/juniper.md +++ b/docs/auditor/10.8/configuration/networkdevices/juniper.md @@ -37,8 +37,8 @@ To configure your Juniper devices, do the following: AND - `` is the name of the UDP port used to listen to network devices (514 port used by - default). [Network Devices](/docs/auditor/10.8/admin/monitoringplans/networkdevices.md) + `` is the name of the UDP port that Netwrix Auditor uses to listen to network + devices (port 514 by default). [Network Devices](/docs/auditor/10.8/admin/monitoringplans/networkdevices.md) # set system syslog time-format `` diff --git a/docs/auditor/10.8/configuration/networkdevices/paloalto.md b/docs/auditor/10.8/configuration/networkdevices/paloalto.md index e94484cd19..41a8e9a858 100644 --- a/docs/auditor/10.8/configuration/networkdevices/paloalto.md +++ b/docs/auditor/10.8/configuration/networkdevices/paloalto.md @@ -15,9 +15,9 @@ may contain warnings, errors, or incomplete audit data. [Antivirus Exclusions for Netwrix Auditor](/docs/kb/auditor/system-administration/security-hardening/antivirus-exclusions-for-netwrix-auditor) knowledge base article for additional information. -Configure native audit settings manually on the Palo Alto device via the web interface: create a -syslog server profile and assign it to the log settings for each log type to ensure Netwrix -Auditor collects comprehensive and reliable audit data. +Configure native audit settings manually on the Palo Alto device via the web interface to ensure +Netwrix Auditor collects comprehensive and reliable audit data. Create a syslog server profile and +assign it to the log settings for each log type. ## Configure a syslog server profile diff --git a/docs/auditor/10.8/configuration/networkdevices/sonicwall.md b/docs/auditor/10.8/configuration/networkdevices/sonicwall.md index d5b8357f25..a1f8c4253d 100644 --- a/docs/auditor/10.8/configuration/networkdevices/sonicwall.md +++ b/docs/auditor/10.8/configuration/networkdevices/sonicwall.md @@ -16,7 +16,7 @@ may contain warnings, errors, or incomplete audit data. knowledge base article for additional information. Configure native audit settings manually on the SonicWall device to ensure Netwrix Auditor -collects comprehensive and reliable audit data, adjusting the log settings for your device type. +collects comprehensive and reliable audit data. Adjust the log settings for your device type. To configure your SonicWall devices, do the following: @@ -102,16 +102,16 @@ Review a full list of object types Netwrix Auditor can collect on SonicWall netw | Object type | Actions | Event ID | | ------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Logon | - Successful logon | - User login from an internal zone allowed - User login successful - XAUTH Succeeded with VPN - VPN zone remote user login allowed - WAN zone remote user login allowed - PPP: Authentication successful - Local Authentication Success - RADIUS/LDAP Authentication Success - Successful authentication received for Remotely Triggered - IKEv2 Authentication successful - SSL VPN zone remote user login allowed | -| - Failed logon | - User login denied - User login failed - XAUTH Failed with VPN - L2TP PPP Authentication Failed - check username / password - RADIUS/LDAP reports Authentication Failure - Local Authentication Failure - User login to Administration Portal denied - User login failure rate exceeded - User Name authentication Failure locally - ISAKMP_AUTH_FAILED - Guest service limit reached - Guest login denied - Incorrect authentication received for Remotely Triggered - Authentication Timeout during Remotely Triggered - Problem occurred during user group membership retrieval - An error has occurred while sending your - IPsec Authentication Failed | | +| - Failed logon | - User login denied - User login failed - XAUTH Failed with VPN - L2TP PPP Authentication Failed - check username / password - RADIUS/LDAP reports Authentication Failure - Local Authentication Failure - User log in to Administration Portal denied - User login failure rate exceeded - User Name authentication Failure locally - ISAKMP_AUTH_FAILED - Guest service limit reached - Guest login denied - Incorrect authentication received for Remotely Triggered - Authentication Timeout during Remotely Triggered - Problem occurred during user group membership retrieval - An error has occurred while sending your - IPsec Authentication Failed | | | - Logoff | - User logged out - logged out - Guest Session Timeout - Guest Account Timeout - Guest Idle Timeout - Guest traffic quota exceeded | | | Authentication | - Successful Logon | - Administrator login allowed - CLI administrator login allowed - VPN zone administrator login allowed - WAN zone administrator login allowed - Configuration mode administration session started - Read-only mode GUI administration session started - Non-config mode GUI administration session started - User login successful - Session Start: - EventMessage: Session Start Success | -| - Failed Logon | - Administrator login denied - CLI administrator login denied due to bad credentials - User login failed - The account has been disabled for - is not permitted for this Web App - Authentication for user - Authentication failed - maximum authentication attempts exceeded for - EventMessage: Session Start Failed | | +| - Failed Logon | - Administrator login denied - CLI administrator login denied due to bad credentials - User login failed - The account has been disabled for - isn't permitted for this Web App - Authentication for user - Authentication failed - maximum authentication attempts exceeded for - EventMessage: Session Start Failed | | | - Logoff | - Administrator logged out - CLI administrator logged out - Configuration mode administration session ended - GUI administration session ended - Logged out - Session End: - EventMessage: Session End - Command='Tunnel' | | | Configuration | - Add / Added (Failed attempt) | - m=1333 - Scheduled settings generated - A new default Self-Signed certificate was generated successfully - Scheduled Tech Support Report generated - Restarted Tech Support Report generated | | - Modified / Modify (Failed attempt) | - Mail attachment disabled - Watch and report possible SYN floods - Watch and proxy WAN connections when under attack - Always proxy WAN connections - SYN Flood blacklisting enabled by user - SYN Flood blacklisting disabled by user - Administrator name changed - VPN disabled by administrator - VPN enabled by administrator - WLAN disabled by administrator - WLAN enabled by administrator - WLAN disabled by schedule - WLAN enabled by schedule - is added into Group - is removed from Group - m=1334 - Update administrator/user lockout params - Settings imported - Critical Operating System Update failed - msg=\"WAF restarted - HTTP(S) Cache settings were updated - database has been updated - Web Server Fingerprint Protection enforced - About to reconfigure service: - Finished applying configuration changes - Started - Start failed - Stopped | | -| - Read / Read (Failed attempt) | - m=1203 - m=1204 - Problem loading the URL list - Registration Update Needed, Please restore your existing security service subscriptions - Failed to synchronize license information with Licensing Server - Current settings exported - Error sending - settings sent successfully - Automated scheduled settings successful - Scheduled settings downloaded - Tech Support Report - Tech Support Report sent successfully - Loaded WAF signature database successfully - Error sending - logs sent out successfully | | +| - Read / Read (Failed attempt) | - m=1203 - m=1204 - Problem loading the URL list - Registration Update Needed, restore your existing security service subscriptions - Failed to synchronize license information with Licensing Server - Current settings exported - Error sending - settings sent successfully - Automated scheduled settings successful - Scheduled settings downloaded - Tech Support Report - Tech Support Report sent successfully - Loaded WAF signature database successfully - Error sending - logs sent out successfully | | | | - Remove / Removed (Failed attempt) | - Scheduled settings deleted - Oldest scheduled Tech Support Report deleted - has been deleted - Event Logs cleared - Audit Logs cleared - Access Logs cleared - Deleting log files - Deleting core files - Deleting snapshots older | -| Device state | - Modified / Modify (Failed attempt) | - Registration Update Needed, Please restore your existing security service subscriptions - Intrusion Prevention (IDP) subscription has expired - Failed to synchronize license information with Licensing Server | +| Device state | - Modified / Modify (Failed attempt) | - Registration Update Needed, restore your existing security service subscriptions - Intrusion Prevention (IDP) subscription has expired - Failed to synchronize license information with Licensing Server | | Folder | - Add / Added (Failed attempt) | - Request='GET /cgi-bin/sonicfiles?RacNumber=9&Arg1= | | - Read / Read (Failed attempt) | - Request='GET /cgi-bin/sonicfiles?RacNumber=16&Arg1= | | | - Remove / Removed (Failed attempt) | - Request='GET /cgi-bin/sonicfiles?RacNumber=13&Arg1= | | diff --git a/docs/auditor/10.9/configuration/networkdevices/ciscoasa.md b/docs/auditor/10.9/configuration/networkdevices/ciscoasa.md index 9a15910af7..357b90b67d 100644 --- a/docs/auditor/10.9/configuration/networkdevices/ciscoasa.md +++ b/docs/auditor/10.9/configuration/networkdevices/ciscoasa.md @@ -20,13 +20,13 @@ settings manually on the Cisco ASA device. When you finish, the device has the f - The global configuration mode is enabled. - The `logging enable` option is turned on. -- The `logging host` parameter is set to the host address of the audited Cisco ASA device, using a - UDP port (for example, 514) to send messages. +- The `logging host` parameter specifies the host address of the audited Cisco ASA device, and the + device uses a UDP port (for example, 514) to send messages. **NOTE:** Don't select the EMBLEM format logging for the syslog server option. - The `logging timestamp` option is enabled. -- The `logging trap` option is set from 1 to 6 inclusive. +- The `logging trap` option uses a value from 1 to 6 inclusive. To configure your Cisco ASA devices, do the following: diff --git a/docs/auditor/10.9/configuration/networkdevices/ciscoios.md b/docs/auditor/10.9/configuration/networkdevices/ciscoios.md index ea81e53c73..bd75b3f764 100644 --- a/docs/auditor/10.9/configuration/networkdevices/ciscoios.md +++ b/docs/auditor/10.9/configuration/networkdevices/ciscoios.md @@ -20,9 +20,9 @@ settings manually on the Cisco IOS device. When you finish, the device has the f - The global configuration mode is enabled. - The `logging timestamp` option is enabled. -- The `logging trap` option is set from 1 to 6 inclusive. -- The `logging host` parameter is set to the host address of the computer that hosts Netwrix - Auditor Server, using a UDP port (for example, 514) to send messages. +- The `logging trap` option uses a value from 1 to 6 inclusive. +- The `logging host` parameter specifies the host address of the computer that hosts Netwrix + Auditor Server, and the device uses a UDP port (for example, 514) to send messages. To configure your Cisco IOS devices, do the following: diff --git a/docs/auditor/10.9/configuration/networkdevices/juniper.md b/docs/auditor/10.9/configuration/networkdevices/juniper.md index d482e61641..9eafa278cb 100644 --- a/docs/auditor/10.9/configuration/networkdevices/juniper.md +++ b/docs/auditor/10.9/configuration/networkdevices/juniper.md @@ -37,8 +37,8 @@ To configure your Juniper devices, do the following: AND - `` is the name of the UDP port used to listen to network devices (514 port used by - default). [Network Devices](/docs/auditor/10.9/admin/monitoringplans/networkdevices.md) + `` is the name of the UDP port that Netwrix Auditor uses to listen to network + devices (port 514 by default). [Network Devices](/docs/auditor/10.9/admin/monitoringplans/networkdevices.md) # set system syslog time-format `` diff --git a/docs/auditor/10.9/configuration/networkdevices/paloalto.md b/docs/auditor/10.9/configuration/networkdevices/paloalto.md index e94484cd19..41a8e9a858 100644 --- a/docs/auditor/10.9/configuration/networkdevices/paloalto.md +++ b/docs/auditor/10.9/configuration/networkdevices/paloalto.md @@ -15,9 +15,9 @@ may contain warnings, errors, or incomplete audit data. [Antivirus Exclusions for Netwrix Auditor](/docs/kb/auditor/system-administration/security-hardening/antivirus-exclusions-for-netwrix-auditor) knowledge base article for additional information. -Configure native audit settings manually on the Palo Alto device via the web interface: create a -syslog server profile and assign it to the log settings for each log type to ensure Netwrix -Auditor collects comprehensive and reliable audit data. +Configure native audit settings manually on the Palo Alto device via the web interface to ensure +Netwrix Auditor collects comprehensive and reliable audit data. Create a syslog server profile and +assign it to the log settings for each log type. ## Configure a syslog server profile diff --git a/docs/auditor/10.9/configuration/networkdevices/sonicwall.md b/docs/auditor/10.9/configuration/networkdevices/sonicwall.md index d5b8357f25..a1f8c4253d 100644 --- a/docs/auditor/10.9/configuration/networkdevices/sonicwall.md +++ b/docs/auditor/10.9/configuration/networkdevices/sonicwall.md @@ -16,7 +16,7 @@ may contain warnings, errors, or incomplete audit data. knowledge base article for additional information. Configure native audit settings manually on the SonicWall device to ensure Netwrix Auditor -collects comprehensive and reliable audit data, adjusting the log settings for your device type. +collects comprehensive and reliable audit data. Adjust the log settings for your device type. To configure your SonicWall devices, do the following: @@ -102,16 +102,16 @@ Review a full list of object types Netwrix Auditor can collect on SonicWall netw | Object type | Actions | Event ID | | ------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Logon | - Successful logon | - User login from an internal zone allowed - User login successful - XAUTH Succeeded with VPN - VPN zone remote user login allowed - WAN zone remote user login allowed - PPP: Authentication successful - Local Authentication Success - RADIUS/LDAP Authentication Success - Successful authentication received for Remotely Triggered - IKEv2 Authentication successful - SSL VPN zone remote user login allowed | -| - Failed logon | - User login denied - User login failed - XAUTH Failed with VPN - L2TP PPP Authentication Failed - check username / password - RADIUS/LDAP reports Authentication Failure - Local Authentication Failure - User login to Administration Portal denied - User login failure rate exceeded - User Name authentication Failure locally - ISAKMP_AUTH_FAILED - Guest service limit reached - Guest login denied - Incorrect authentication received for Remotely Triggered - Authentication Timeout during Remotely Triggered - Problem occurred during user group membership retrieval - An error has occurred while sending your - IPsec Authentication Failed | | +| - Failed logon | - User login denied - User login failed - XAUTH Failed with VPN - L2TP PPP Authentication Failed - check username / password - RADIUS/LDAP reports Authentication Failure - Local Authentication Failure - User log in to Administration Portal denied - User login failure rate exceeded - User Name authentication Failure locally - ISAKMP_AUTH_FAILED - Guest service limit reached - Guest login denied - Incorrect authentication received for Remotely Triggered - Authentication Timeout during Remotely Triggered - Problem occurred during user group membership retrieval - An error has occurred while sending your - IPsec Authentication Failed | | | - Logoff | - User logged out - logged out - Guest Session Timeout - Guest Account Timeout - Guest Idle Timeout - Guest traffic quota exceeded | | | Authentication | - Successful Logon | - Administrator login allowed - CLI administrator login allowed - VPN zone administrator login allowed - WAN zone administrator login allowed - Configuration mode administration session started - Read-only mode GUI administration session started - Non-config mode GUI administration session started - User login successful - Session Start: - EventMessage: Session Start Success | -| - Failed Logon | - Administrator login denied - CLI administrator login denied due to bad credentials - User login failed - The account has been disabled for - is not permitted for this Web App - Authentication for user - Authentication failed - maximum authentication attempts exceeded for - EventMessage: Session Start Failed | | +| - Failed Logon | - Administrator login denied - CLI administrator login denied due to bad credentials - User login failed - The account has been disabled for - isn't permitted for this Web App - Authentication for user - Authentication failed - maximum authentication attempts exceeded for - EventMessage: Session Start Failed | | | - Logoff | - Administrator logged out - CLI administrator logged out - Configuration mode administration session ended - GUI administration session ended - Logged out - Session End: - EventMessage: Session End - Command='Tunnel' | | | Configuration | - Add / Added (Failed attempt) | - m=1333 - Scheduled settings generated - A new default Self-Signed certificate was generated successfully - Scheduled Tech Support Report generated - Restarted Tech Support Report generated | | - Modified / Modify (Failed attempt) | - Mail attachment disabled - Watch and report possible SYN floods - Watch and proxy WAN connections when under attack - Always proxy WAN connections - SYN Flood blacklisting enabled by user - SYN Flood blacklisting disabled by user - Administrator name changed - VPN disabled by administrator - VPN enabled by administrator - WLAN disabled by administrator - WLAN enabled by administrator - WLAN disabled by schedule - WLAN enabled by schedule - is added into Group - is removed from Group - m=1334 - Update administrator/user lockout params - Settings imported - Critical Operating System Update failed - msg=\"WAF restarted - HTTP(S) Cache settings were updated - database has been updated - Web Server Fingerprint Protection enforced - About to reconfigure service: - Finished applying configuration changes - Started - Start failed - Stopped | | -| - Read / Read (Failed attempt) | - m=1203 - m=1204 - Problem loading the URL list - Registration Update Needed, Please restore your existing security service subscriptions - Failed to synchronize license information with Licensing Server - Current settings exported - Error sending - settings sent successfully - Automated scheduled settings successful - Scheduled settings downloaded - Tech Support Report - Tech Support Report sent successfully - Loaded WAF signature database successfully - Error sending - logs sent out successfully | | +| - Read / Read (Failed attempt) | - m=1203 - m=1204 - Problem loading the URL list - Registration Update Needed, restore your existing security service subscriptions - Failed to synchronize license information with Licensing Server - Current settings exported - Error sending - settings sent successfully - Automated scheduled settings successful - Scheduled settings downloaded - Tech Support Report - Tech Support Report sent successfully - Loaded WAF signature database successfully - Error sending - logs sent out successfully | | | | - Remove / Removed (Failed attempt) | - Scheduled settings deleted - Oldest scheduled Tech Support Report deleted - has been deleted - Event Logs cleared - Audit Logs cleared - Access Logs cleared - Deleting log files - Deleting core files - Deleting snapshots older | -| Device state | - Modified / Modify (Failed attempt) | - Registration Update Needed, Please restore your existing security service subscriptions - Intrusion Prevention (IDP) subscription has expired - Failed to synchronize license information with Licensing Server | +| Device state | - Modified / Modify (Failed attempt) | - Registration Update Needed, restore your existing security service subscriptions - Intrusion Prevention (IDP) subscription has expired - Failed to synchronize license information with Licensing Server | | Folder | - Add / Added (Failed attempt) | - Request='GET /cgi-bin/sonicfiles?RacNumber=9&Arg1= | | - Read / Read (Failed attempt) | - Request='GET /cgi-bin/sonicfiles?RacNumber=16&Arg1= | | | - Remove / Removed (Failed attempt) | - Request='GET /cgi-bin/sonicfiles?RacNumber=13&Arg1= | | From e888f2b48611788a0a36aeaca779809a0e2f5a42 Mon Sep 17 00:00:00 2001 From: TheCat Date: Wed, 19 Aug 2026 10:34:34 +0100 Subject: [PATCH 8/9] Normalize passive-voice style and fix grammar per Dale review - ciscoasa.md, ciscoios.md: normalize the settings list back to consistent end-state phrasing ('is set to', 'is enabled') across all 5 bullets. A prior autofix pass had converted 2 of the 5 bullets to active voice (Dale flagged the other 3 as legitimate passive-voice skips), leaving the list stylistically inconsistent. - sonicwall.md: fix 'In the dialog appears, select Create new address object option' -> 'In the dialog that appears, select the Create new address object option' (missing relative pronoun and article; not a verbatim device string, so safe to fix). Also re-restore the 4 verbatim SonicWall event strings and 2 table rows' padding, which a subsequent vale-autofix run had altered again after the previous fix commit. Applied to Auditor 10.7, 10.8, and 10.9. Co-Authored-By: Claude Sonnet 5 --- .../10.7/configuration/networkdevices/ciscoasa.md | 6 +++--- .../10.7/configuration/networkdevices/ciscoios.md | 6 +++--- .../10.7/configuration/networkdevices/sonicwall.md | 12 ++++++------ .../10.8/configuration/networkdevices/ciscoasa.md | 6 +++--- .../10.8/configuration/networkdevices/ciscoios.md | 6 +++--- .../10.8/configuration/networkdevices/sonicwall.md | 12 ++++++------ .../10.9/configuration/networkdevices/ciscoasa.md | 6 +++--- .../10.9/configuration/networkdevices/ciscoios.md | 6 +++--- .../10.9/configuration/networkdevices/sonicwall.md | 12 ++++++------ 9 files changed, 36 insertions(+), 36 deletions(-) diff --git a/docs/auditor/10.7/configuration/networkdevices/ciscoasa.md b/docs/auditor/10.7/configuration/networkdevices/ciscoasa.md index 357b90b67d..9a15910af7 100644 --- a/docs/auditor/10.7/configuration/networkdevices/ciscoasa.md +++ b/docs/auditor/10.7/configuration/networkdevices/ciscoasa.md @@ -20,13 +20,13 @@ settings manually on the Cisco ASA device. When you finish, the device has the f - The global configuration mode is enabled. - The `logging enable` option is turned on. -- The `logging host` parameter specifies the host address of the audited Cisco ASA device, and the - device uses a UDP port (for example, 514) to send messages. +- The `logging host` parameter is set to the host address of the audited Cisco ASA device, using a + UDP port (for example, 514) to send messages. **NOTE:** Don't select the EMBLEM format logging for the syslog server option. - The `logging timestamp` option is enabled. -- The `logging trap` option uses a value from 1 to 6 inclusive. +- The `logging trap` option is set from 1 to 6 inclusive. To configure your Cisco ASA devices, do the following: diff --git a/docs/auditor/10.7/configuration/networkdevices/ciscoios.md b/docs/auditor/10.7/configuration/networkdevices/ciscoios.md index bd75b3f764..ea81e53c73 100644 --- a/docs/auditor/10.7/configuration/networkdevices/ciscoios.md +++ b/docs/auditor/10.7/configuration/networkdevices/ciscoios.md @@ -20,9 +20,9 @@ settings manually on the Cisco IOS device. When you finish, the device has the f - The global configuration mode is enabled. - The `logging timestamp` option is enabled. -- The `logging trap` option uses a value from 1 to 6 inclusive. -- The `logging host` parameter specifies the host address of the computer that hosts Netwrix - Auditor Server, and the device uses a UDP port (for example, 514) to send messages. +- The `logging trap` option is set from 1 to 6 inclusive. +- The `logging host` parameter is set to the host address of the computer that hosts Netwrix + Auditor Server, using a UDP port (for example, 514) to send messages. To configure your Cisco IOS devices, do the following: diff --git a/docs/auditor/10.7/configuration/networkdevices/sonicwall.md b/docs/auditor/10.7/configuration/networkdevices/sonicwall.md index a1f8c4253d..ccd1c1b3f3 100644 --- a/docs/auditor/10.7/configuration/networkdevices/sonicwall.md +++ b/docs/auditor/10.7/configuration/networkdevices/sonicwall.md @@ -86,8 +86,8 @@ To configure SonicWall NS series 6. Navigate to Manage → Log Settings → Syslog. 7. Set the Syslog Format to Default. 8. Click Add. -9. In the dialog appears, select Create new address object option in the Name or IP Address combo - box. +9. In the dialog that appears, select the Create new address object option in the Name or IP + Address combo box. 10. Provide name and IP address of the new object. 11. Click OK. 12. In the Add Syslog Server dialog, in the Name or IP Address list, find the IP address you @@ -102,16 +102,16 @@ Review a full list of object types Netwrix Auditor can collect on SonicWall netw | Object type | Actions | Event ID | | ------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Logon | - Successful logon | - User login from an internal zone allowed - User login successful - XAUTH Succeeded with VPN - VPN zone remote user login allowed - WAN zone remote user login allowed - PPP: Authentication successful - Local Authentication Success - RADIUS/LDAP Authentication Success - Successful authentication received for Remotely Triggered - IKEv2 Authentication successful - SSL VPN zone remote user login allowed | -| - Failed logon | - User login denied - User login failed - XAUTH Failed with VPN - L2TP PPP Authentication Failed - check username / password - RADIUS/LDAP reports Authentication Failure - Local Authentication Failure - User log in to Administration Portal denied - User login failure rate exceeded - User Name authentication Failure locally - ISAKMP_AUTH_FAILED - Guest service limit reached - Guest login denied - Incorrect authentication received for Remotely Triggered - Authentication Timeout during Remotely Triggered - Problem occurred during user group membership retrieval - An error has occurred while sending your - IPsec Authentication Failed | | +| - Failed logon | - User login denied - User login failed - XAUTH Failed with VPN - L2TP PPP Authentication Failed - check username / password - RADIUS/LDAP reports Authentication Failure - Local Authentication Failure - User login to Administration Portal denied - User login failure rate exceeded - User Name authentication Failure locally - ISAKMP_AUTH_FAILED - Guest service limit reached - Guest login denied - Incorrect authentication received for Remotely Triggered - Authentication Timeout during Remotely Triggered - Problem occurred during user group membership retrieval - An error has occurred while sending your - IPsec Authentication Failed | | | - Logoff | - User logged out - logged out - Guest Session Timeout - Guest Account Timeout - Guest Idle Timeout - Guest traffic quota exceeded | | | Authentication | - Successful Logon | - Administrator login allowed - CLI administrator login allowed - VPN zone administrator login allowed - WAN zone administrator login allowed - Configuration mode administration session started - Read-only mode GUI administration session started - Non-config mode GUI administration session started - User login successful - Session Start: - EventMessage: Session Start Success | -| - Failed Logon | - Administrator login denied - CLI administrator login denied due to bad credentials - User login failed - The account has been disabled for - isn't permitted for this Web App - Authentication for user - Authentication failed - maximum authentication attempts exceeded for - EventMessage: Session Start Failed | | +| - Failed Logon | - Administrator login denied - CLI administrator login denied due to bad credentials - User login failed - The account has been disabled for - is not permitted for this Web App - Authentication for user - Authentication failed - maximum authentication attempts exceeded for - EventMessage: Session Start Failed | | | - Logoff | - Administrator logged out - CLI administrator logged out - Configuration mode administration session ended - GUI administration session ended - Logged out - Session End: - EventMessage: Session End - Command='Tunnel' | | | Configuration | - Add / Added (Failed attempt) | - m=1333 - Scheduled settings generated - A new default Self-Signed certificate was generated successfully - Scheduled Tech Support Report generated - Restarted Tech Support Report generated | | - Modified / Modify (Failed attempt) | - Mail attachment disabled - Watch and report possible SYN floods - Watch and proxy WAN connections when under attack - Always proxy WAN connections - SYN Flood blacklisting enabled by user - SYN Flood blacklisting disabled by user - Administrator name changed - VPN disabled by administrator - VPN enabled by administrator - WLAN disabled by administrator - WLAN enabled by administrator - WLAN disabled by schedule - WLAN enabled by schedule - is added into Group - is removed from Group - m=1334 - Update administrator/user lockout params - Settings imported - Critical Operating System Update failed - msg=\"WAF restarted - HTTP(S) Cache settings were updated - database has been updated - Web Server Fingerprint Protection enforced - About to reconfigure service: - Finished applying configuration changes - Started - Start failed - Stopped | | -| - Read / Read (Failed attempt) | - m=1203 - m=1204 - Problem loading the URL list - Registration Update Needed, restore your existing security service subscriptions - Failed to synchronize license information with Licensing Server - Current settings exported - Error sending - settings sent successfully - Automated scheduled settings successful - Scheduled settings downloaded - Tech Support Report - Tech Support Report sent successfully - Loaded WAF signature database successfully - Error sending - logs sent out successfully | | +| - Read / Read (Failed attempt) | - m=1203 - m=1204 - Problem loading the URL list - Registration Update Needed, Please restore your existing security service subscriptions - Failed to synchronize license information with Licensing Server - Current settings exported - Error sending - settings sent successfully - Automated scheduled settings successful - Scheduled settings downloaded - Tech Support Report - Tech Support Report sent successfully - Loaded WAF signature database successfully - Error sending - logs sent out successfully | | | | - Remove / Removed (Failed attempt) | - Scheduled settings deleted - Oldest scheduled Tech Support Report deleted - has been deleted - Event Logs cleared - Audit Logs cleared - Access Logs cleared - Deleting log files - Deleting core files - Deleting snapshots older | -| Device state | - Modified / Modify (Failed attempt) | - Registration Update Needed, restore your existing security service subscriptions - Intrusion Prevention (IDP) subscription has expired - Failed to synchronize license information with Licensing Server | +| Device state | - Modified / Modify (Failed attempt) | - Registration Update Needed, Please restore your existing security service subscriptions - Intrusion Prevention (IDP) subscription has expired - Failed to synchronize license information with Licensing Server | | Folder | - Add / Added (Failed attempt) | - Request='GET /cgi-bin/sonicfiles?RacNumber=9&Arg1= | | - Read / Read (Failed attempt) | - Request='GET /cgi-bin/sonicfiles?RacNumber=16&Arg1= | | | - Remove / Removed (Failed attempt) | - Request='GET /cgi-bin/sonicfiles?RacNumber=13&Arg1= | | diff --git a/docs/auditor/10.8/configuration/networkdevices/ciscoasa.md b/docs/auditor/10.8/configuration/networkdevices/ciscoasa.md index 357b90b67d..9a15910af7 100644 --- a/docs/auditor/10.8/configuration/networkdevices/ciscoasa.md +++ b/docs/auditor/10.8/configuration/networkdevices/ciscoasa.md @@ -20,13 +20,13 @@ settings manually on the Cisco ASA device. When you finish, the device has the f - The global configuration mode is enabled. - The `logging enable` option is turned on. -- The `logging host` parameter specifies the host address of the audited Cisco ASA device, and the - device uses a UDP port (for example, 514) to send messages. +- The `logging host` parameter is set to the host address of the audited Cisco ASA device, using a + UDP port (for example, 514) to send messages. **NOTE:** Don't select the EMBLEM format logging for the syslog server option. - The `logging timestamp` option is enabled. -- The `logging trap` option uses a value from 1 to 6 inclusive. +- The `logging trap` option is set from 1 to 6 inclusive. To configure your Cisco ASA devices, do the following: diff --git a/docs/auditor/10.8/configuration/networkdevices/ciscoios.md b/docs/auditor/10.8/configuration/networkdevices/ciscoios.md index bd75b3f764..ea81e53c73 100644 --- a/docs/auditor/10.8/configuration/networkdevices/ciscoios.md +++ b/docs/auditor/10.8/configuration/networkdevices/ciscoios.md @@ -20,9 +20,9 @@ settings manually on the Cisco IOS device. When you finish, the device has the f - The global configuration mode is enabled. - The `logging timestamp` option is enabled. -- The `logging trap` option uses a value from 1 to 6 inclusive. -- The `logging host` parameter specifies the host address of the computer that hosts Netwrix - Auditor Server, and the device uses a UDP port (for example, 514) to send messages. +- The `logging trap` option is set from 1 to 6 inclusive. +- The `logging host` parameter is set to the host address of the computer that hosts Netwrix + Auditor Server, using a UDP port (for example, 514) to send messages. To configure your Cisco IOS devices, do the following: diff --git a/docs/auditor/10.8/configuration/networkdevices/sonicwall.md b/docs/auditor/10.8/configuration/networkdevices/sonicwall.md index a1f8c4253d..ccd1c1b3f3 100644 --- a/docs/auditor/10.8/configuration/networkdevices/sonicwall.md +++ b/docs/auditor/10.8/configuration/networkdevices/sonicwall.md @@ -86,8 +86,8 @@ To configure SonicWall NS series 6. Navigate to Manage → Log Settings → Syslog. 7. Set the Syslog Format to Default. 8. Click Add. -9. In the dialog appears, select Create new address object option in the Name or IP Address combo - box. +9. In the dialog that appears, select the Create new address object option in the Name or IP + Address combo box. 10. Provide name and IP address of the new object. 11. Click OK. 12. In the Add Syslog Server dialog, in the Name or IP Address list, find the IP address you @@ -102,16 +102,16 @@ Review a full list of object types Netwrix Auditor can collect on SonicWall netw | Object type | Actions | Event ID | | ------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Logon | - Successful logon | - User login from an internal zone allowed - User login successful - XAUTH Succeeded with VPN - VPN zone remote user login allowed - WAN zone remote user login allowed - PPP: Authentication successful - Local Authentication Success - RADIUS/LDAP Authentication Success - Successful authentication received for Remotely Triggered - IKEv2 Authentication successful - SSL VPN zone remote user login allowed | -| - Failed logon | - User login denied - User login failed - XAUTH Failed with VPN - L2TP PPP Authentication Failed - check username / password - RADIUS/LDAP reports Authentication Failure - Local Authentication Failure - User log in to Administration Portal denied - User login failure rate exceeded - User Name authentication Failure locally - ISAKMP_AUTH_FAILED - Guest service limit reached - Guest login denied - Incorrect authentication received for Remotely Triggered - Authentication Timeout during Remotely Triggered - Problem occurred during user group membership retrieval - An error has occurred while sending your - IPsec Authentication Failed | | +| - Failed logon | - User login denied - User login failed - XAUTH Failed with VPN - L2TP PPP Authentication Failed - check username / password - RADIUS/LDAP reports Authentication Failure - Local Authentication Failure - User login to Administration Portal denied - User login failure rate exceeded - User Name authentication Failure locally - ISAKMP_AUTH_FAILED - Guest service limit reached - Guest login denied - Incorrect authentication received for Remotely Triggered - Authentication Timeout during Remotely Triggered - Problem occurred during user group membership retrieval - An error has occurred while sending your - IPsec Authentication Failed | | | - Logoff | - User logged out - logged out - Guest Session Timeout - Guest Account Timeout - Guest Idle Timeout - Guest traffic quota exceeded | | | Authentication | - Successful Logon | - Administrator login allowed - CLI administrator login allowed - VPN zone administrator login allowed - WAN zone administrator login allowed - Configuration mode administration session started - Read-only mode GUI administration session started - Non-config mode GUI administration session started - User login successful - Session Start: - EventMessage: Session Start Success | -| - Failed Logon | - Administrator login denied - CLI administrator login denied due to bad credentials - User login failed - The account has been disabled for - isn't permitted for this Web App - Authentication for user - Authentication failed - maximum authentication attempts exceeded for - EventMessage: Session Start Failed | | +| - Failed Logon | - Administrator login denied - CLI administrator login denied due to bad credentials - User login failed - The account has been disabled for - is not permitted for this Web App - Authentication for user - Authentication failed - maximum authentication attempts exceeded for - EventMessage: Session Start Failed | | | - Logoff | - Administrator logged out - CLI administrator logged out - Configuration mode administration session ended - GUI administration session ended - Logged out - Session End: - EventMessage: Session End - Command='Tunnel' | | | Configuration | - Add / Added (Failed attempt) | - m=1333 - Scheduled settings generated - A new default Self-Signed certificate was generated successfully - Scheduled Tech Support Report generated - Restarted Tech Support Report generated | | - Modified / Modify (Failed attempt) | - Mail attachment disabled - Watch and report possible SYN floods - Watch and proxy WAN connections when under attack - Always proxy WAN connections - SYN Flood blacklisting enabled by user - SYN Flood blacklisting disabled by user - Administrator name changed - VPN disabled by administrator - VPN enabled by administrator - WLAN disabled by administrator - WLAN enabled by administrator - WLAN disabled by schedule - WLAN enabled by schedule - is added into Group - is removed from Group - m=1334 - Update administrator/user lockout params - Settings imported - Critical Operating System Update failed - msg=\"WAF restarted - HTTP(S) Cache settings were updated - database has been updated - Web Server Fingerprint Protection enforced - About to reconfigure service: - Finished applying configuration changes - Started - Start failed - Stopped | | -| - Read / Read (Failed attempt) | - m=1203 - m=1204 - Problem loading the URL list - Registration Update Needed, restore your existing security service subscriptions - Failed to synchronize license information with Licensing Server - Current settings exported - Error sending - settings sent successfully - Automated scheduled settings successful - Scheduled settings downloaded - Tech Support Report - Tech Support Report sent successfully - Loaded WAF signature database successfully - Error sending - logs sent out successfully | | +| - Read / Read (Failed attempt) | - m=1203 - m=1204 - Problem loading the URL list - Registration Update Needed, Please restore your existing security service subscriptions - Failed to synchronize license information with Licensing Server - Current settings exported - Error sending - settings sent successfully - Automated scheduled settings successful - Scheduled settings downloaded - Tech Support Report - Tech Support Report sent successfully - Loaded WAF signature database successfully - Error sending - logs sent out successfully | | | | - Remove / Removed (Failed attempt) | - Scheduled settings deleted - Oldest scheduled Tech Support Report deleted - has been deleted - Event Logs cleared - Audit Logs cleared - Access Logs cleared - Deleting log files - Deleting core files - Deleting snapshots older | -| Device state | - Modified / Modify (Failed attempt) | - Registration Update Needed, restore your existing security service subscriptions - Intrusion Prevention (IDP) subscription has expired - Failed to synchronize license information with Licensing Server | +| Device state | - Modified / Modify (Failed attempt) | - Registration Update Needed, Please restore your existing security service subscriptions - Intrusion Prevention (IDP) subscription has expired - Failed to synchronize license information with Licensing Server | | Folder | - Add / Added (Failed attempt) | - Request='GET /cgi-bin/sonicfiles?RacNumber=9&Arg1= | | - Read / Read (Failed attempt) | - Request='GET /cgi-bin/sonicfiles?RacNumber=16&Arg1= | | | - Remove / Removed (Failed attempt) | - Request='GET /cgi-bin/sonicfiles?RacNumber=13&Arg1= | | diff --git a/docs/auditor/10.9/configuration/networkdevices/ciscoasa.md b/docs/auditor/10.9/configuration/networkdevices/ciscoasa.md index 357b90b67d..9a15910af7 100644 --- a/docs/auditor/10.9/configuration/networkdevices/ciscoasa.md +++ b/docs/auditor/10.9/configuration/networkdevices/ciscoasa.md @@ -20,13 +20,13 @@ settings manually on the Cisco ASA device. When you finish, the device has the f - The global configuration mode is enabled. - The `logging enable` option is turned on. -- The `logging host` parameter specifies the host address of the audited Cisco ASA device, and the - device uses a UDP port (for example, 514) to send messages. +- The `logging host` parameter is set to the host address of the audited Cisco ASA device, using a + UDP port (for example, 514) to send messages. **NOTE:** Don't select the EMBLEM format logging for the syslog server option. - The `logging timestamp` option is enabled. -- The `logging trap` option uses a value from 1 to 6 inclusive. +- The `logging trap` option is set from 1 to 6 inclusive. To configure your Cisco ASA devices, do the following: diff --git a/docs/auditor/10.9/configuration/networkdevices/ciscoios.md b/docs/auditor/10.9/configuration/networkdevices/ciscoios.md index bd75b3f764..ea81e53c73 100644 --- a/docs/auditor/10.9/configuration/networkdevices/ciscoios.md +++ b/docs/auditor/10.9/configuration/networkdevices/ciscoios.md @@ -20,9 +20,9 @@ settings manually on the Cisco IOS device. When you finish, the device has the f - The global configuration mode is enabled. - The `logging timestamp` option is enabled. -- The `logging trap` option uses a value from 1 to 6 inclusive. -- The `logging host` parameter specifies the host address of the computer that hosts Netwrix - Auditor Server, and the device uses a UDP port (for example, 514) to send messages. +- The `logging trap` option is set from 1 to 6 inclusive. +- The `logging host` parameter is set to the host address of the computer that hosts Netwrix + Auditor Server, using a UDP port (for example, 514) to send messages. To configure your Cisco IOS devices, do the following: diff --git a/docs/auditor/10.9/configuration/networkdevices/sonicwall.md b/docs/auditor/10.9/configuration/networkdevices/sonicwall.md index a1f8c4253d..ccd1c1b3f3 100644 --- a/docs/auditor/10.9/configuration/networkdevices/sonicwall.md +++ b/docs/auditor/10.9/configuration/networkdevices/sonicwall.md @@ -86,8 +86,8 @@ To configure SonicWall NS series 6. Navigate to Manage → Log Settings → Syslog. 7. Set the Syslog Format to Default. 8. Click Add. -9. In the dialog appears, select Create new address object option in the Name or IP Address combo - box. +9. In the dialog that appears, select the Create new address object option in the Name or IP + Address combo box. 10. Provide name and IP address of the new object. 11. Click OK. 12. In the Add Syslog Server dialog, in the Name or IP Address list, find the IP address you @@ -102,16 +102,16 @@ Review a full list of object types Netwrix Auditor can collect on SonicWall netw | Object type | Actions | Event ID | | ------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Logon | - Successful logon | - User login from an internal zone allowed - User login successful - XAUTH Succeeded with VPN - VPN zone remote user login allowed - WAN zone remote user login allowed - PPP: Authentication successful - Local Authentication Success - RADIUS/LDAP Authentication Success - Successful authentication received for Remotely Triggered - IKEv2 Authentication successful - SSL VPN zone remote user login allowed | -| - Failed logon | - User login denied - User login failed - XAUTH Failed with VPN - L2TP PPP Authentication Failed - check username / password - RADIUS/LDAP reports Authentication Failure - Local Authentication Failure - User log in to Administration Portal denied - User login failure rate exceeded - User Name authentication Failure locally - ISAKMP_AUTH_FAILED - Guest service limit reached - Guest login denied - Incorrect authentication received for Remotely Triggered - Authentication Timeout during Remotely Triggered - Problem occurred during user group membership retrieval - An error has occurred while sending your - IPsec Authentication Failed | | +| - Failed logon | - User login denied - User login failed - XAUTH Failed with VPN - L2TP PPP Authentication Failed - check username / password - RADIUS/LDAP reports Authentication Failure - Local Authentication Failure - User login to Administration Portal denied - User login failure rate exceeded - User Name authentication Failure locally - ISAKMP_AUTH_FAILED - Guest service limit reached - Guest login denied - Incorrect authentication received for Remotely Triggered - Authentication Timeout during Remotely Triggered - Problem occurred during user group membership retrieval - An error has occurred while sending your - IPsec Authentication Failed | | | - Logoff | - User logged out - logged out - Guest Session Timeout - Guest Account Timeout - Guest Idle Timeout - Guest traffic quota exceeded | | | Authentication | - Successful Logon | - Administrator login allowed - CLI administrator login allowed - VPN zone administrator login allowed - WAN zone administrator login allowed - Configuration mode administration session started - Read-only mode GUI administration session started - Non-config mode GUI administration session started - User login successful - Session Start: - EventMessage: Session Start Success | -| - Failed Logon | - Administrator login denied - CLI administrator login denied due to bad credentials - User login failed - The account has been disabled for - isn't permitted for this Web App - Authentication for user - Authentication failed - maximum authentication attempts exceeded for - EventMessage: Session Start Failed | | +| - Failed Logon | - Administrator login denied - CLI administrator login denied due to bad credentials - User login failed - The account has been disabled for - is not permitted for this Web App - Authentication for user - Authentication failed - maximum authentication attempts exceeded for - EventMessage: Session Start Failed | | | - Logoff | - Administrator logged out - CLI administrator logged out - Configuration mode administration session ended - GUI administration session ended - Logged out - Session End: - EventMessage: Session End - Command='Tunnel' | | | Configuration | - Add / Added (Failed attempt) | - m=1333 - Scheduled settings generated - A new default Self-Signed certificate was generated successfully - Scheduled Tech Support Report generated - Restarted Tech Support Report generated | | - Modified / Modify (Failed attempt) | - Mail attachment disabled - Watch and report possible SYN floods - Watch and proxy WAN connections when under attack - Always proxy WAN connections - SYN Flood blacklisting enabled by user - SYN Flood blacklisting disabled by user - Administrator name changed - VPN disabled by administrator - VPN enabled by administrator - WLAN disabled by administrator - WLAN enabled by administrator - WLAN disabled by schedule - WLAN enabled by schedule - is added into Group - is removed from Group - m=1334 - Update administrator/user lockout params - Settings imported - Critical Operating System Update failed - msg=\"WAF restarted - HTTP(S) Cache settings were updated - database has been updated - Web Server Fingerprint Protection enforced - About to reconfigure service: - Finished applying configuration changes - Started - Start failed - Stopped | | -| - Read / Read (Failed attempt) | - m=1203 - m=1204 - Problem loading the URL list - Registration Update Needed, restore your existing security service subscriptions - Failed to synchronize license information with Licensing Server - Current settings exported - Error sending - settings sent successfully - Automated scheduled settings successful - Scheduled settings downloaded - Tech Support Report - Tech Support Report sent successfully - Loaded WAF signature database successfully - Error sending - logs sent out successfully | | +| - Read / Read (Failed attempt) | - m=1203 - m=1204 - Problem loading the URL list - Registration Update Needed, Please restore your existing security service subscriptions - Failed to synchronize license information with Licensing Server - Current settings exported - Error sending - settings sent successfully - Automated scheduled settings successful - Scheduled settings downloaded - Tech Support Report - Tech Support Report sent successfully - Loaded WAF signature database successfully - Error sending - logs sent out successfully | | | | - Remove / Removed (Failed attempt) | - Scheduled settings deleted - Oldest scheduled Tech Support Report deleted - has been deleted - Event Logs cleared - Audit Logs cleared - Access Logs cleared - Deleting log files - Deleting core files - Deleting snapshots older | -| Device state | - Modified / Modify (Failed attempt) | - Registration Update Needed, restore your existing security service subscriptions - Intrusion Prevention (IDP) subscription has expired - Failed to synchronize license information with Licensing Server | +| Device state | - Modified / Modify (Failed attempt) | - Registration Update Needed, Please restore your existing security service subscriptions - Intrusion Prevention (IDP) subscription has expired - Failed to synchronize license information with Licensing Server | | Folder | - Add / Added (Failed attempt) | - Request='GET /cgi-bin/sonicfiles?RacNumber=9&Arg1= | | - Read / Read (Failed attempt) | - Request='GET /cgi-bin/sonicfiles?RacNumber=16&Arg1= | | | - Remove / Removed (Failed attempt) | - Request='GET /cgi-bin/sonicfiles?RacNumber=13&Arg1= | | From 4232ea4a943a1409b683b9742798f56143354352 Mon Sep 17 00:00:00 2001 From: "claude[bot]" <41898282+claude[bot]@users.noreply.github.com> Date: Wed, 19 Aug 2026 09:41:23 +0000 Subject: [PATCH 9/9] fix(vale): auto-fix style issues (Vale + Dale) --- .../10.7/configuration/networkdevices/ciscoasa.md | 4 ++-- .../10.7/configuration/networkdevices/ciscoios.md | 2 +- .../10.7/configuration/networkdevices/paloalto.md | 2 +- .../10.7/configuration/networkdevices/sonicwall.md | 12 ++++++------ .../10.8/configuration/networkdevices/ciscoasa.md | 4 ++-- .../10.8/configuration/networkdevices/ciscoios.md | 2 +- .../10.8/configuration/networkdevices/paloalto.md | 2 +- .../10.8/configuration/networkdevices/sonicwall.md | 12 ++++++------ .../10.9/configuration/networkdevices/ciscoasa.md | 4 ++-- .../10.9/configuration/networkdevices/ciscoios.md | 2 +- .../10.9/configuration/networkdevices/paloalto.md | 2 +- .../10.9/configuration/networkdevices/sonicwall.md | 12 ++++++------ 12 files changed, 30 insertions(+), 30 deletions(-) diff --git a/docs/auditor/10.7/configuration/networkdevices/ciscoasa.md b/docs/auditor/10.7/configuration/networkdevices/ciscoasa.md index 9a15910af7..31cc07277d 100644 --- a/docs/auditor/10.7/configuration/networkdevices/ciscoasa.md +++ b/docs/auditor/10.7/configuration/networkdevices/ciscoasa.md @@ -20,8 +20,8 @@ settings manually on the Cisco ASA device. When you finish, the device has the f - The global configuration mode is enabled. - The `logging enable` option is turned on. -- The `logging host` parameter is set to the host address of the audited Cisco ASA device, using a - UDP port (for example, 514) to send messages. +- The `logging host` parameter is set to the host address of the audited Cisco ASA device, and the + device uses a UDP port (for example, 514) to send messages. **NOTE:** Don't select the EMBLEM format logging for the syslog server option. diff --git a/docs/auditor/10.7/configuration/networkdevices/ciscoios.md b/docs/auditor/10.7/configuration/networkdevices/ciscoios.md index ea81e53c73..94b90a85d5 100644 --- a/docs/auditor/10.7/configuration/networkdevices/ciscoios.md +++ b/docs/auditor/10.7/configuration/networkdevices/ciscoios.md @@ -22,7 +22,7 @@ settings manually on the Cisco IOS device. When you finish, the device has the f - The `logging timestamp` option is enabled. - The `logging trap` option is set from 1 to 6 inclusive. - The `logging host` parameter is set to the host address of the computer that hosts Netwrix - Auditor Server, using a UDP port (for example, 514) to send messages. + Auditor Server, and the device uses a UDP port (for example, 514) to send messages. To configure your Cisco IOS devices, do the following: diff --git a/docs/auditor/10.7/configuration/networkdevices/paloalto.md b/docs/auditor/10.7/configuration/networkdevices/paloalto.md index 41a8e9a858..76e486862d 100644 --- a/docs/auditor/10.7/configuration/networkdevices/paloalto.md +++ b/docs/auditor/10.7/configuration/networkdevices/paloalto.md @@ -35,7 +35,7 @@ the firewall in the URL field (https://``). | Name | Specify unique name for a syslog server. | | Syslog Server | Provide a server name by entering its FQDN or IPv4 address. | | Transport | Select UDP. | -| Port | Provide the name of the UDP port used to listen to network devices (514 port used by default). | +| Port | Provide the name of the UDP port that Netwrix Auditor uses to listen to network devices (port 514 by default). | | Format | Select IETF. | | Facility | Netwrix recommends using default values. | diff --git a/docs/auditor/10.7/configuration/networkdevices/sonicwall.md b/docs/auditor/10.7/configuration/networkdevices/sonicwall.md index ccd1c1b3f3..0778713a8d 100644 --- a/docs/auditor/10.7/configuration/networkdevices/sonicwall.md +++ b/docs/auditor/10.7/configuration/networkdevices/sonicwall.md @@ -33,7 +33,7 @@ To configure SonicWall Web Application Firewall | - Log Level - Alert Level - Syslog Level | Set to "Info". | | - Enable Audit Log - Send to Syslog Server in Audit Log Settings - Send to Syslog Server in Access Log Settings | Select these checkboxes. | | Primary Syslog Server | Enter the address of your Netwrix Auditor Server. | - | Primary Syslog Server Port | Provide the name of the UDP port used to listen to network devices (514 port used by default). | + | Primary Syslog Server Port | Provide the name of the UDP port that Netwrix Auditor uses to listen to network devices (port 514 by default). | 4. Click Accept. 5. Navigate to Log → Categories. @@ -60,7 +60,7 @@ To configure SonicWall SMA | - Log Level - Alert Level - Syslog Level | Set to "Info". | | - Enable Audit Log - Send to Syslog Server in Audit Log Settings - Send to Syslog Server in Access Log Settings | Select these checkboxes. | | Primary Syslog Server | Enter the address of your Netwrix Auditor Server. | - | Primary Syslog Server Port | Provide the name of the UDP port used to listen to network devices (514 port used by default). | + | Primary Syslog Server Port | Provide the name of the UDP port that Netwrix Auditor uses to listen to network devices (port 514 by default). | 4. Click Accept. 5. Navigate to Log → Categories. @@ -102,16 +102,16 @@ Review a full list of object types Netwrix Auditor can collect on SonicWall netw | Object type | Actions | Event ID | | ------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Logon | - Successful logon | - User login from an internal zone allowed - User login successful - XAUTH Succeeded with VPN - VPN zone remote user login allowed - WAN zone remote user login allowed - PPP: Authentication successful - Local Authentication Success - RADIUS/LDAP Authentication Success - Successful authentication received for Remotely Triggered - IKEv2 Authentication successful - SSL VPN zone remote user login allowed | -| - Failed logon | - User login denied - User login failed - XAUTH Failed with VPN - L2TP PPP Authentication Failed - check username / password - RADIUS/LDAP reports Authentication Failure - Local Authentication Failure - User login to Administration Portal denied - User login failure rate exceeded - User Name authentication Failure locally - ISAKMP_AUTH_FAILED - Guest service limit reached - Guest login denied - Incorrect authentication received for Remotely Triggered - Authentication Timeout during Remotely Triggered - Problem occurred during user group membership retrieval - An error has occurred while sending your - IPsec Authentication Failed | | +| - Failed logon | - User login denied - User login failed - XAUTH Failed with VPN - L2TP PPP Authentication Failed - check username / password - RADIUS/LDAP reports Authentication Failure - Local Authentication Failure - User log in to Administration Portal denied - User login failure rate exceeded - User Name authentication Failure locally - ISAKMP_AUTH_FAILED - Guest service limit reached - Guest login denied - Incorrect authentication received for Remotely Triggered - Authentication Timeout during Remotely Triggered - Problem occurred during user group membership retrieval - An error has occurred while sending your - IPsec Authentication Failed | | | - Logoff | - User logged out - logged out - Guest Session Timeout - Guest Account Timeout - Guest Idle Timeout - Guest traffic quota exceeded | | | Authentication | - Successful Logon | - Administrator login allowed - CLI administrator login allowed - VPN zone administrator login allowed - WAN zone administrator login allowed - Configuration mode administration session started - Read-only mode GUI administration session started - Non-config mode GUI administration session started - User login successful - Session Start: - EventMessage: Session Start Success | -| - Failed Logon | - Administrator login denied - CLI administrator login denied due to bad credentials - User login failed - The account has been disabled for - is not permitted for this Web App - Authentication for user - Authentication failed - maximum authentication attempts exceeded for - EventMessage: Session Start Failed | | +| - Failed Logon | - Administrator login denied - CLI administrator login denied due to bad credentials - User login failed - The account has been disabled for - isn't permitted for this Web App - Authentication for user - Authentication failed - maximum authentication attempts exceeded for - EventMessage: Session Start Failed | | | - Logoff | - Administrator logged out - CLI administrator logged out - Configuration mode administration session ended - GUI administration session ended - Logged out - Session End: - EventMessage: Session End - Command='Tunnel' | | | Configuration | - Add / Added (Failed attempt) | - m=1333 - Scheduled settings generated - A new default Self-Signed certificate was generated successfully - Scheduled Tech Support Report generated - Restarted Tech Support Report generated | | - Modified / Modify (Failed attempt) | - Mail attachment disabled - Watch and report possible SYN floods - Watch and proxy WAN connections when under attack - Always proxy WAN connections - SYN Flood blacklisting enabled by user - SYN Flood blacklisting disabled by user - Administrator name changed - VPN disabled by administrator - VPN enabled by administrator - WLAN disabled by administrator - WLAN enabled by administrator - WLAN disabled by schedule - WLAN enabled by schedule - is added into Group - is removed from Group - m=1334 - Update administrator/user lockout params - Settings imported - Critical Operating System Update failed - msg=\"WAF restarted - HTTP(S) Cache settings were updated - database has been updated - Web Server Fingerprint Protection enforced - About to reconfigure service: - Finished applying configuration changes - Started - Start failed - Stopped | | -| - Read / Read (Failed attempt) | - m=1203 - m=1204 - Problem loading the URL list - Registration Update Needed, Please restore your existing security service subscriptions - Failed to synchronize license information with Licensing Server - Current settings exported - Error sending - settings sent successfully - Automated scheduled settings successful - Scheduled settings downloaded - Tech Support Report - Tech Support Report sent successfully - Loaded WAF signature database successfully - Error sending - logs sent out successfully | | +| - Read / Read (Failed attempt) | - m=1203 - m=1204 - Problem loading the URL list - Registration Update Needed, restore your existing security service subscriptions - Failed to synchronize license information with Licensing Server - Current settings exported - Error sending - settings sent successfully - Automated scheduled settings successful - Scheduled settings downloaded - Tech Support Report - Tech Support Report sent successfully - Loaded WAF signature database successfully - Error sending - logs sent out successfully | | | | - Remove / Removed (Failed attempt) | - Scheduled settings deleted - Oldest scheduled Tech Support Report deleted - has been deleted - Event Logs cleared - Audit Logs cleared - Access Logs cleared - Deleting log files - Deleting core files - Deleting snapshots older | -| Device state | - Modified / Modify (Failed attempt) | - Registration Update Needed, Please restore your existing security service subscriptions - Intrusion Prevention (IDP) subscription has expired - Failed to synchronize license information with Licensing Server | +| Device state | - Modified / Modify (Failed attempt) | - Registration Update Needed, restore your existing security service subscriptions - Intrusion Prevention (IDP) subscription has expired - Failed to synchronize license information with Licensing Server | | Folder | - Add / Added (Failed attempt) | - Request='GET /cgi-bin/sonicfiles?RacNumber=9&Arg1= | | - Read / Read (Failed attempt) | - Request='GET /cgi-bin/sonicfiles?RacNumber=16&Arg1= | | | - Remove / Removed (Failed attempt) | - Request='GET /cgi-bin/sonicfiles?RacNumber=13&Arg1= | | diff --git a/docs/auditor/10.8/configuration/networkdevices/ciscoasa.md b/docs/auditor/10.8/configuration/networkdevices/ciscoasa.md index 9a15910af7..31cc07277d 100644 --- a/docs/auditor/10.8/configuration/networkdevices/ciscoasa.md +++ b/docs/auditor/10.8/configuration/networkdevices/ciscoasa.md @@ -20,8 +20,8 @@ settings manually on the Cisco ASA device. When you finish, the device has the f - The global configuration mode is enabled. - The `logging enable` option is turned on. -- The `logging host` parameter is set to the host address of the audited Cisco ASA device, using a - UDP port (for example, 514) to send messages. +- The `logging host` parameter is set to the host address of the audited Cisco ASA device, and the + device uses a UDP port (for example, 514) to send messages. **NOTE:** Don't select the EMBLEM format logging for the syslog server option. diff --git a/docs/auditor/10.8/configuration/networkdevices/ciscoios.md b/docs/auditor/10.8/configuration/networkdevices/ciscoios.md index ea81e53c73..94b90a85d5 100644 --- a/docs/auditor/10.8/configuration/networkdevices/ciscoios.md +++ b/docs/auditor/10.8/configuration/networkdevices/ciscoios.md @@ -22,7 +22,7 @@ settings manually on the Cisco IOS device. When you finish, the device has the f - The `logging timestamp` option is enabled. - The `logging trap` option is set from 1 to 6 inclusive. - The `logging host` parameter is set to the host address of the computer that hosts Netwrix - Auditor Server, using a UDP port (for example, 514) to send messages. + Auditor Server, and the device uses a UDP port (for example, 514) to send messages. To configure your Cisco IOS devices, do the following: diff --git a/docs/auditor/10.8/configuration/networkdevices/paloalto.md b/docs/auditor/10.8/configuration/networkdevices/paloalto.md index 41a8e9a858..76e486862d 100644 --- a/docs/auditor/10.8/configuration/networkdevices/paloalto.md +++ b/docs/auditor/10.8/configuration/networkdevices/paloalto.md @@ -35,7 +35,7 @@ the firewall in the URL field (https://``). | Name | Specify unique name for a syslog server. | | Syslog Server | Provide a server name by entering its FQDN or IPv4 address. | | Transport | Select UDP. | -| Port | Provide the name of the UDP port used to listen to network devices (514 port used by default). | +| Port | Provide the name of the UDP port that Netwrix Auditor uses to listen to network devices (port 514 by default). | | Format | Select IETF. | | Facility | Netwrix recommends using default values. | diff --git a/docs/auditor/10.8/configuration/networkdevices/sonicwall.md b/docs/auditor/10.8/configuration/networkdevices/sonicwall.md index ccd1c1b3f3..0778713a8d 100644 --- a/docs/auditor/10.8/configuration/networkdevices/sonicwall.md +++ b/docs/auditor/10.8/configuration/networkdevices/sonicwall.md @@ -33,7 +33,7 @@ To configure SonicWall Web Application Firewall | - Log Level - Alert Level - Syslog Level | Set to "Info". | | - Enable Audit Log - Send to Syslog Server in Audit Log Settings - Send to Syslog Server in Access Log Settings | Select these checkboxes. | | Primary Syslog Server | Enter the address of your Netwrix Auditor Server. | - | Primary Syslog Server Port | Provide the name of the UDP port used to listen to network devices (514 port used by default). | + | Primary Syslog Server Port | Provide the name of the UDP port that Netwrix Auditor uses to listen to network devices (port 514 by default). | 4. Click Accept. 5. Navigate to Log → Categories. @@ -60,7 +60,7 @@ To configure SonicWall SMA | - Log Level - Alert Level - Syslog Level | Set to "Info". | | - Enable Audit Log - Send to Syslog Server in Audit Log Settings - Send to Syslog Server in Access Log Settings | Select these checkboxes. | | Primary Syslog Server | Enter the address of your Netwrix Auditor Server. | - | Primary Syslog Server Port | Provide the name of the UDP port used to listen to network devices (514 port used by default). | + | Primary Syslog Server Port | Provide the name of the UDP port that Netwrix Auditor uses to listen to network devices (port 514 by default). | 4. Click Accept. 5. Navigate to Log → Categories. @@ -102,16 +102,16 @@ Review a full list of object types Netwrix Auditor can collect on SonicWall netw | Object type | Actions | Event ID | | ------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Logon | - Successful logon | - User login from an internal zone allowed - User login successful - XAUTH Succeeded with VPN - VPN zone remote user login allowed - WAN zone remote user login allowed - PPP: Authentication successful - Local Authentication Success - RADIUS/LDAP Authentication Success - Successful authentication received for Remotely Triggered - IKEv2 Authentication successful - SSL VPN zone remote user login allowed | -| - Failed logon | - User login denied - User login failed - XAUTH Failed with VPN - L2TP PPP Authentication Failed - check username / password - RADIUS/LDAP reports Authentication Failure - Local Authentication Failure - User login to Administration Portal denied - User login failure rate exceeded - User Name authentication Failure locally - ISAKMP_AUTH_FAILED - Guest service limit reached - Guest login denied - Incorrect authentication received for Remotely Triggered - Authentication Timeout during Remotely Triggered - Problem occurred during user group membership retrieval - An error has occurred while sending your - IPsec Authentication Failed | | +| - Failed logon | - User login denied - User login failed - XAUTH Failed with VPN - L2TP PPP Authentication Failed - check username / password - RADIUS/LDAP reports Authentication Failure - Local Authentication Failure - User log in to Administration Portal denied - User login failure rate exceeded - User Name authentication Failure locally - ISAKMP_AUTH_FAILED - Guest service limit reached - Guest login denied - Incorrect authentication received for Remotely Triggered - Authentication Timeout during Remotely Triggered - Problem occurred during user group membership retrieval - An error has occurred while sending your - IPsec Authentication Failed | | | - Logoff | - User logged out - logged out - Guest Session Timeout - Guest Account Timeout - Guest Idle Timeout - Guest traffic quota exceeded | | | Authentication | - Successful Logon | - Administrator login allowed - CLI administrator login allowed - VPN zone administrator login allowed - WAN zone administrator login allowed - Configuration mode administration session started - Read-only mode GUI administration session started - Non-config mode GUI administration session started - User login successful - Session Start: - EventMessage: Session Start Success | -| - Failed Logon | - Administrator login denied - CLI administrator login denied due to bad credentials - User login failed - The account has been disabled for - is not permitted for this Web App - Authentication for user - Authentication failed - maximum authentication attempts exceeded for - EventMessage: Session Start Failed | | +| - Failed Logon | - Administrator login denied - CLI administrator login denied due to bad credentials - User login failed - The account has been disabled for - isn't permitted for this Web App - Authentication for user - Authentication failed - maximum authentication attempts exceeded for - EventMessage: Session Start Failed | | | - Logoff | - Administrator logged out - CLI administrator logged out - Configuration mode administration session ended - GUI administration session ended - Logged out - Session End: - EventMessage: Session End - Command='Tunnel' | | | Configuration | - Add / Added (Failed attempt) | - m=1333 - Scheduled settings generated - A new default Self-Signed certificate was generated successfully - Scheduled Tech Support Report generated - Restarted Tech Support Report generated | | - Modified / Modify (Failed attempt) | - Mail attachment disabled - Watch and report possible SYN floods - Watch and proxy WAN connections when under attack - Always proxy WAN connections - SYN Flood blacklisting enabled by user - SYN Flood blacklisting disabled by user - Administrator name changed - VPN disabled by administrator - VPN enabled by administrator - WLAN disabled by administrator - WLAN enabled by administrator - WLAN disabled by schedule - WLAN enabled by schedule - is added into Group - is removed from Group - m=1334 - Update administrator/user lockout params - Settings imported - Critical Operating System Update failed - msg=\"WAF restarted - HTTP(S) Cache settings were updated - database has been updated - Web Server Fingerprint Protection enforced - About to reconfigure service: - Finished applying configuration changes - Started - Start failed - Stopped | | -| - Read / Read (Failed attempt) | - m=1203 - m=1204 - Problem loading the URL list - Registration Update Needed, Please restore your existing security service subscriptions - Failed to synchronize license information with Licensing Server - Current settings exported - Error sending - settings sent successfully - Automated scheduled settings successful - Scheduled settings downloaded - Tech Support Report - Tech Support Report sent successfully - Loaded WAF signature database successfully - Error sending - logs sent out successfully | | +| - Read / Read (Failed attempt) | - m=1203 - m=1204 - Problem loading the URL list - Registration Update Needed, restore your existing security service subscriptions - Failed to synchronize license information with Licensing Server - Current settings exported - Error sending - settings sent successfully - Automated scheduled settings successful - Scheduled settings downloaded - Tech Support Report - Tech Support Report sent successfully - Loaded WAF signature database successfully - Error sending - logs sent out successfully | | | | - Remove / Removed (Failed attempt) | - Scheduled settings deleted - Oldest scheduled Tech Support Report deleted - has been deleted - Event Logs cleared - Audit Logs cleared - Access Logs cleared - Deleting log files - Deleting core files - Deleting snapshots older | -| Device state | - Modified / Modify (Failed attempt) | - Registration Update Needed, Please restore your existing security service subscriptions - Intrusion Prevention (IDP) subscription has expired - Failed to synchronize license information with Licensing Server | +| Device state | - Modified / Modify (Failed attempt) | - Registration Update Needed, restore your existing security service subscriptions - Intrusion Prevention (IDP) subscription has expired - Failed to synchronize license information with Licensing Server | | Folder | - Add / Added (Failed attempt) | - Request='GET /cgi-bin/sonicfiles?RacNumber=9&Arg1= | | - Read / Read (Failed attempt) | - Request='GET /cgi-bin/sonicfiles?RacNumber=16&Arg1= | | | - Remove / Removed (Failed attempt) | - Request='GET /cgi-bin/sonicfiles?RacNumber=13&Arg1= | | diff --git a/docs/auditor/10.9/configuration/networkdevices/ciscoasa.md b/docs/auditor/10.9/configuration/networkdevices/ciscoasa.md index 9a15910af7..31cc07277d 100644 --- a/docs/auditor/10.9/configuration/networkdevices/ciscoasa.md +++ b/docs/auditor/10.9/configuration/networkdevices/ciscoasa.md @@ -20,8 +20,8 @@ settings manually on the Cisco ASA device. When you finish, the device has the f - The global configuration mode is enabled. - The `logging enable` option is turned on. -- The `logging host` parameter is set to the host address of the audited Cisco ASA device, using a - UDP port (for example, 514) to send messages. +- The `logging host` parameter is set to the host address of the audited Cisco ASA device, and the + device uses a UDP port (for example, 514) to send messages. **NOTE:** Don't select the EMBLEM format logging for the syslog server option. diff --git a/docs/auditor/10.9/configuration/networkdevices/ciscoios.md b/docs/auditor/10.9/configuration/networkdevices/ciscoios.md index ea81e53c73..94b90a85d5 100644 --- a/docs/auditor/10.9/configuration/networkdevices/ciscoios.md +++ b/docs/auditor/10.9/configuration/networkdevices/ciscoios.md @@ -22,7 +22,7 @@ settings manually on the Cisco IOS device. When you finish, the device has the f - The `logging timestamp` option is enabled. - The `logging trap` option is set from 1 to 6 inclusive. - The `logging host` parameter is set to the host address of the computer that hosts Netwrix - Auditor Server, using a UDP port (for example, 514) to send messages. + Auditor Server, and the device uses a UDP port (for example, 514) to send messages. To configure your Cisco IOS devices, do the following: diff --git a/docs/auditor/10.9/configuration/networkdevices/paloalto.md b/docs/auditor/10.9/configuration/networkdevices/paloalto.md index 41a8e9a858..76e486862d 100644 --- a/docs/auditor/10.9/configuration/networkdevices/paloalto.md +++ b/docs/auditor/10.9/configuration/networkdevices/paloalto.md @@ -35,7 +35,7 @@ the firewall in the URL field (https://``). | Name | Specify unique name for a syslog server. | | Syslog Server | Provide a server name by entering its FQDN or IPv4 address. | | Transport | Select UDP. | -| Port | Provide the name of the UDP port used to listen to network devices (514 port used by default). | +| Port | Provide the name of the UDP port that Netwrix Auditor uses to listen to network devices (port 514 by default). | | Format | Select IETF. | | Facility | Netwrix recommends using default values. | diff --git a/docs/auditor/10.9/configuration/networkdevices/sonicwall.md b/docs/auditor/10.9/configuration/networkdevices/sonicwall.md index ccd1c1b3f3..0778713a8d 100644 --- a/docs/auditor/10.9/configuration/networkdevices/sonicwall.md +++ b/docs/auditor/10.9/configuration/networkdevices/sonicwall.md @@ -33,7 +33,7 @@ To configure SonicWall Web Application Firewall | - Log Level - Alert Level - Syslog Level | Set to "Info". | | - Enable Audit Log - Send to Syslog Server in Audit Log Settings - Send to Syslog Server in Access Log Settings | Select these checkboxes. | | Primary Syslog Server | Enter the address of your Netwrix Auditor Server. | - | Primary Syslog Server Port | Provide the name of the UDP port used to listen to network devices (514 port used by default). | + | Primary Syslog Server Port | Provide the name of the UDP port that Netwrix Auditor uses to listen to network devices (port 514 by default). | 4. Click Accept. 5. Navigate to Log → Categories. @@ -60,7 +60,7 @@ To configure SonicWall SMA | - Log Level - Alert Level - Syslog Level | Set to "Info". | | - Enable Audit Log - Send to Syslog Server in Audit Log Settings - Send to Syslog Server in Access Log Settings | Select these checkboxes. | | Primary Syslog Server | Enter the address of your Netwrix Auditor Server. | - | Primary Syslog Server Port | Provide the name of the UDP port used to listen to network devices (514 port used by default). | + | Primary Syslog Server Port | Provide the name of the UDP port that Netwrix Auditor uses to listen to network devices (port 514 by default). | 4. Click Accept. 5. Navigate to Log → Categories. @@ -102,16 +102,16 @@ Review a full list of object types Netwrix Auditor can collect on SonicWall netw | Object type | Actions | Event ID | | ------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Logon | - Successful logon | - User login from an internal zone allowed - User login successful - XAUTH Succeeded with VPN - VPN zone remote user login allowed - WAN zone remote user login allowed - PPP: Authentication successful - Local Authentication Success - RADIUS/LDAP Authentication Success - Successful authentication received for Remotely Triggered - IKEv2 Authentication successful - SSL VPN zone remote user login allowed | -| - Failed logon | - User login denied - User login failed - XAUTH Failed with VPN - L2TP PPP Authentication Failed - check username / password - RADIUS/LDAP reports Authentication Failure - Local Authentication Failure - User login to Administration Portal denied - User login failure rate exceeded - User Name authentication Failure locally - ISAKMP_AUTH_FAILED - Guest service limit reached - Guest login denied - Incorrect authentication received for Remotely Triggered - Authentication Timeout during Remotely Triggered - Problem occurred during user group membership retrieval - An error has occurred while sending your - IPsec Authentication Failed | | +| - Failed logon | - User login denied - User login failed - XAUTH Failed with VPN - L2TP PPP Authentication Failed - check username / password - RADIUS/LDAP reports Authentication Failure - Local Authentication Failure - User log in to Administration Portal denied - User login failure rate exceeded - User Name authentication Failure locally - ISAKMP_AUTH_FAILED - Guest service limit reached - Guest login denied - Incorrect authentication received for Remotely Triggered - Authentication Timeout during Remotely Triggered - Problem occurred during user group membership retrieval - An error has occurred while sending your - IPsec Authentication Failed | | | - Logoff | - User logged out - logged out - Guest Session Timeout - Guest Account Timeout - Guest Idle Timeout - Guest traffic quota exceeded | | | Authentication | - Successful Logon | - Administrator login allowed - CLI administrator login allowed - VPN zone administrator login allowed - WAN zone administrator login allowed - Configuration mode administration session started - Read-only mode GUI administration session started - Non-config mode GUI administration session started - User login successful - Session Start: - EventMessage: Session Start Success | -| - Failed Logon | - Administrator login denied - CLI administrator login denied due to bad credentials - User login failed - The account has been disabled for - is not permitted for this Web App - Authentication for user - Authentication failed - maximum authentication attempts exceeded for - EventMessage: Session Start Failed | | +| - Failed Logon | - Administrator login denied - CLI administrator login denied due to bad credentials - User login failed - The account has been disabled for - isn't permitted for this Web App - Authentication for user - Authentication failed - maximum authentication attempts exceeded for - EventMessage: Session Start Failed | | | - Logoff | - Administrator logged out - CLI administrator logged out - Configuration mode administration session ended - GUI administration session ended - Logged out - Session End: - EventMessage: Session End - Command='Tunnel' | | | Configuration | - Add / Added (Failed attempt) | - m=1333 - Scheduled settings generated - A new default Self-Signed certificate was generated successfully - Scheduled Tech Support Report generated - Restarted Tech Support Report generated | | - Modified / Modify (Failed attempt) | - Mail attachment disabled - Watch and report possible SYN floods - Watch and proxy WAN connections when under attack - Always proxy WAN connections - SYN Flood blacklisting enabled by user - SYN Flood blacklisting disabled by user - Administrator name changed - VPN disabled by administrator - VPN enabled by administrator - WLAN disabled by administrator - WLAN enabled by administrator - WLAN disabled by schedule - WLAN enabled by schedule - is added into Group - is removed from Group - m=1334 - Update administrator/user lockout params - Settings imported - Critical Operating System Update failed - msg=\"WAF restarted - HTTP(S) Cache settings were updated - database has been updated - Web Server Fingerprint Protection enforced - About to reconfigure service: - Finished applying configuration changes - Started - Start failed - Stopped | | -| - Read / Read (Failed attempt) | - m=1203 - m=1204 - Problem loading the URL list - Registration Update Needed, Please restore your existing security service subscriptions - Failed to synchronize license information with Licensing Server - Current settings exported - Error sending - settings sent successfully - Automated scheduled settings successful - Scheduled settings downloaded - Tech Support Report - Tech Support Report sent successfully - Loaded WAF signature database successfully - Error sending - logs sent out successfully | | +| - Read / Read (Failed attempt) | - m=1203 - m=1204 - Problem loading the URL list - Registration Update Needed, restore your existing security service subscriptions - Failed to synchronize license information with Licensing Server - Current settings exported - Error sending - settings sent successfully - Automated scheduled settings successful - Scheduled settings downloaded - Tech Support Report - Tech Support Report sent successfully - Loaded WAF signature database successfully - Error sending - logs sent out successfully | | | | - Remove / Removed (Failed attempt) | - Scheduled settings deleted - Oldest scheduled Tech Support Report deleted - has been deleted - Event Logs cleared - Audit Logs cleared - Access Logs cleared - Deleting log files - Deleting core files - Deleting snapshots older | -| Device state | - Modified / Modify (Failed attempt) | - Registration Update Needed, Please restore your existing security service subscriptions - Intrusion Prevention (IDP) subscription has expired - Failed to synchronize license information with Licensing Server | +| Device state | - Modified / Modify (Failed attempt) | - Registration Update Needed, restore your existing security service subscriptions - Intrusion Prevention (IDP) subscription has expired - Failed to synchronize license information with Licensing Server | | Folder | - Add / Added (Failed attempt) | - Request='GET /cgi-bin/sonicfiles?RacNumber=9&Arg1= | | - Read / Read (Failed attempt) | - Request='GET /cgi-bin/sonicfiles?RacNumber=16&Arg1= | | | - Remove / Removed (Failed attempt) | - Request='GET /cgi-bin/sonicfiles?RacNumber=13&Arg1= | |