How to Detect and Investigate Unusual User Behavior Using Netwrix Auditor 8.5

Netwrix Auditor is a visibility and governance platform that allows you to monitor changes, configurations and access in IT infrastructure of important IT infrastructure components such as Active Directory, Event logs, Exchange, Office 365, SQL Server, and others.

Contents:

• Installing Netwrix Auditor
• Initial configuration
• Generating reports
• Change management
• User Behavior Analytics
• Add-on Store
• Final points 

As part of the company’s remediation scenario, your CIO orders you to generate detailed reports of Active Directory account privilege use within the domain over the past two months. To generate the report, you plan to crawl the log data from your 4 domain controllers, 8 database servers, and 16 infrastructure servers. In so doing, you realize that you’re in big trouble because you’re overwhelmed with audit log data with no summarization or relevance filtering.

Installing Netwrix Auditor:

You can work with Netwrix either on-premises or in the cloud. Here are the options:

• On-prem installer: The server component runs on Windows Server, and the client component runs on Windows Server or Windows Client
• Virtual appliance: Preconfigured virtual hard drive that runs on either Hyper-V or VMware
• Cloud VM: Preconfigured virtual machines that run in the Microsoft Azure, Amazon Web Services (AWS) or CenturyLink public clouds

In my environment I downloaded a free 20-day trial of the on-premises Netwrix Auditor installer. As you can see in the next screen capture, the installer gives you all the managed objects in one go:

Initial configuration

You administer Netwrix Auditor by starting the Netwrix Auditor Administrator console, as shown in the following screenshot. This is a garden-variety Microsoft Management Console (MMC) application.

The Netwrix Auditor administrative console.

Deploying auditing with Netwrix involves the following steps:

• Validating your SQL Server database connection (performed in the AuditArchive^TM> Audit Database admin console node)
• Adding and configuring managed objects (performed in the Managed Objects node)
• Configuring your audit policies and real-time alerts

The following screenshot shows the Audit Database screen in the Admin console; this is where we plug Netwrix into your SQL Server database instance. The AuditIntelligence^TM hyperlink opens the Netwrix Auditor client, which we’ll discuss momentarily.


You can define audit policies across many, many servers and services. Here’s the list of included audited systems in Netwrix Auditor 8.5:

• Active Directory
• Group Policy
• Azure AD
• Exchange
• Exchange Online
• SharePoint
• SharePoint Online
• Windows File Servers
• NetApp
• EMC
• Oracle Database
• SQL Server
• Windows Server
• VMware

In my environment I tested the Active Directory application. Check out the following screenshot, where you’ll see two important items:

• List of predefined real-time alerts
• Configuration for the built-in Organizational Unit Deletion alert

All of the alert rules have the same basic options. First, you determine the scope of auditing. For example, do you want to track deletion of only selected OUs, or all of them in your monitored Active Directory domain?

Second, you choose who should be notified when the alert rule is triggered, and how you want the alert delivered. You specify Simple Mail Transfer Protocol (SMTP) server settings under Settings > Email Notifications; you can also have Netwrix Auditor send Short Message Service (SMS) text messages to administrators.


Each managed object also allows you to set data collection schedules, and also set alternative network credentials if they are necessary.

Generating reports

Do you see how this process works? You enable managed objects that match the network services and assets that require auditing, and you configure e-mail or SMS messages for real-time alerts.

But what about generating reports to give to your company’s compliance officers? Well, let’s cover that use case next. Open the Netwrix Auditor client and you’ll see a nice graphical dashboard that looks much like the following screenshot.




The actual report interface should look familiar if you’ve used SQL Server Reporting Services (SSRS). In the following screenshot, look at the toolbar buttons I called out: you can export auditing reports to one of several different formats:

• CSV
• Excel
• MHTML
• PDF
• Physical printer
• TIFF
• Web services data feed (Atom)
• Word
• XML

A user can set subscription to any of the reports or dashboards and start receiving these reports via email according to a schedule he sets. Or the reports can go to a specified folder on a network instead of the email.

If you have reporting needs that go beyond the prebuilt report definitions, you can craft your own search and save this search as ‘custom report’ for later use by Interactive Search, as shown below:

Change management

User Behavior Analytics

Add-on Store

Final points

I’m a big fan of any administrative toolset that helps me to sleep peacefully at night. The fact that Netwrix Auditor saves me from scraping several servers’ worth of log data and Group Policy results is reason alone to justify its purchase. Then there’s the turnkey compliance auditing functionality.


Credit: Timothy Warner